dfbfab57a37980f721f3096a5ce5801ed8e428724c132aafd0d5f286c353d01e

General

Target

2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
Size

170KB
MD5

7f102dcc7063016547c72dc7da74eacb
SHA1

212fbaa08c19ad7e33afeaac266e2e12adc744c8
SHA256

dfbfab57a37980f721f3096a5ce5801ed8e428724c132aafd0d5f286c353d01e
SHA512

62371e8629dc0d2f073836820413000918f9cfe1d0e999e13791aeb0f89dad1157b1687d81708b6ac97218b03f2a66ae9a4c598fbf1f3806defdc9b7f1ff490f
SSDEEP

3072:ZRpAyazIliazTAVZqf6Ddvi+ImQj237MxsqHvhmCeWPaZuD4sPgjuzSDROQBp:xZ8azWY6Zqo7MxsY5eqD4qeQQv

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

SLpIodnVREQ1s4w.exeCTS.exe

pid process

1856 SLpIodnVREQ1s4w.exe
3912 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1856	SLpIodnVREQ1s4w.exe
3912	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 4552 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
Token: SeDebugPrivilege 3912 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
Token: SeDebugPrivilege	3912	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe

description	pid	process	target process
PID 4552 wrote to memory of 1856	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe	SLpIodnVREQ1s4w.exe
PID 4552 wrote to memory of 1856	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe	SLpIodnVREQ1s4w.exe
PID 4552 wrote to memory of 1856	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe	SLpIodnVREQ1s4w.exe
PID 4552 wrote to memory of 3912	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe	CTS.exe
PID 4552 wrote to memory of 3912	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe	CTS.exe
PID 4552 wrote to memory of 3912	4552	2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552

C:\Users\Admin\AppData\Local\Temp\SLpIodnVREQ1s4w.exe
C:\Users\Admin\AppData\Local\Temp\SLpIodnVREQ1s4w.exe
2⤵
- Executes dropped EXE
PID:1856

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
392KB

MD5
ab4c5b6b5acda693d7d3f6abd9207c33

SHA1
a83a4d4704f096db760258c1b4a1635fe082856b

SHA256
5c50bc31ebd050b5ba889b22fb32a361bb63848093aa8305449c8ea19967fd48

SHA512
1dcecd4dc47555b7da3b1eb500f86c8235cb8486cbe2ca7fa8785881049e49776bff1e2eb162c436912bfe9eafd9d7c89766b8088e873bf149135291f94c4ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\SLpIodnVREQ1s4w.exe
Filesize
99KB

MD5
98eea111050b063ba63c6086ed7d4723

SHA1
25cd896907cc56e03af7e2704679fc4cee2b0ff9

SHA256
a8c0b8b5a892198aef71fa68d0a0eb88d3e8d5c541ad6a1ecf5baa0bc95fc403

SHA512
41fc40864664c15bd8d6b1414bee1b79933c8f5a71e67e872c47b185e60ecf7d003613bf44de6d68c70a86e7a59620be6afa90850228dc251c5f61c91d017cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\SLpIodnVREQ1s4w.exe
Filesize
170KB

MD5
9ec28475064b3d7e2d4cf4f89b9fccae

SHA1
5e8ffa0bc97579ce3b96cc3ed75f4a99d891f649

SHA256
01a3528234fa5f2423e4f939102241cedbab2f20d51c1b55d80c9c07d130764c

SHA512
1e87471238df60157aa4745d3d1e5c2966db947c31f231e7a593265c03171078f35e05888f214d85073983b89f7935413c581868a53cc1a4f0dfcf5778102e84

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads