05a5ac259816589cfe9d587fedf385a4c97ff261acaa6e13f0ed046c7d74e469

General

Target

2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Size

302KB
MD5

32b485de524be537089031e977488707
SHA1

1e117bde87726f398e12630180e857c989482972
SHA256

05a5ac259816589cfe9d587fedf385a4c97ff261acaa6e13f0ed046c7d74e469
SHA512

b72cf9b43097307b5a63a7150b4a41c871e267f4ad246e136966fd7b1e1300425be290e84bcdb353222e02678d18d1e0e4de8d3b1d2d9a6fcd4a6eafc2be08d3
SSDEEP

6144:xZ8az7P2BcZeTG2MTLl6c/vp7q6Gvl2MieQCVKYCF:xC0726pLFbG0MlEYu

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

CTS.exelfDMdVO6W6MuGIO.exe

pid process

2408 CTS.exe
3064 lfDMdVO6W6MuGIO.exe
Loads dropped DLL 1 IoCs

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

pid process

2888 2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2408	CTS.exe
3064	lfDMdVO6W6MuGIO.exe

pid	process
2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

CTS.exe2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

description ioc process

File created C:\Windows\CTS.exe CTS.exe
File created C:\Windows\CTS.exe 2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 2888 2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Token: SeDebugPrivilege 2408 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

description	pid	process
Token: SeDebugPrivilege	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Token: SeDebugPrivilege	2408	CTS.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

description	pid	process	target process
PID 2888 wrote to memory of 3064	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	lfDMdVO6W6MuGIO.exe
PID 2888 wrote to memory of 3064	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	lfDMdVO6W6MuGIO.exe
PID 2888 wrote to memory of 3064	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	lfDMdVO6W6MuGIO.exe
PID 2888 wrote to memory of 3064	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	lfDMdVO6W6MuGIO.exe
PID 2888 wrote to memory of 2408	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe
PID 2888 wrote to memory of 2408	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe
PID 2888 wrote to memory of 2408	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe
PID 2888 wrote to memory of 2408	2888	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_32b485de524be537089031e977488707_bkransomware.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888

C:\Users\Admin\AppData\Local\Temp\lfDMdVO6W6MuGIO.exe
C:\Users\Admin\AppData\Local\Temp\lfDMdVO6W6MuGIO.exe
2⤵
- Executes dropped EXE
PID:3064

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2408

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit
\Users\Admin\AppData\Local\Temp\lfDMdVO6W6MuGIO.exe
Filesize
231KB

MD5
022538483dc9f54cdbdc48a16899526c

SHA1
9b372370c29d2cdc72328bc680633212c6aa47fb

SHA256
b9d7fe7dcde0e386122ae04b0ffd3bf9dc7216b031826cfc32f7c6609e3da72d

SHA512
a0979c8779da3cb76d4d490fd9675ceeb516bdc697d2c1138f7ed36197d0e71aa0b036c3460a306f386e7140d09ce5aaec82f1fbcfe3839fcda7413e3badceb5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads