b8cadf3cc959803f9e3b3493a101051c500371a00d8c116e0226bd6d072b7a4b

General

Target

2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe
Size

302KB
MD5

9774d1051af0bec3277a17bfb4561c85
SHA1

3dac3741c5eb8181ed799e0dc621f95928a3e8c2
SHA256

b8cadf3cc959803f9e3b3493a101051c500371a00d8c116e0226bd6d072b7a4b
SHA512

d553157b77e84be558ad48de2ca6cf6aa15222d6550e01b5772abb682ac1143b64f974bb97938237be4793fe2ac896ed169633bcaa6a65476c93a9e8b9394706
SSDEEP

6144:hZMazqoZM4uelnkHv2N9LYdgf/rkgatYNFHyVlJ1ICS:hS0qoZMYnkH/6fYxOGVlfIZ

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Rbdt5d6H2hyRXEc.exeCTS.exe

pid process

2432 Rbdt5d6H2hyRXEc.exe
532 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2432	Rbdt5d6H2hyRXEc.exe
532	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

CTS.exe2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe

description ioc process

File created C:\Windows\CTS.exe CTS.exe
File created C:\Windows\CTS.exe 2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 4544 2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe
Token: SeDebugPrivilege 532 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe

description	pid	process
Token: SeDebugPrivilege	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe
Token: SeDebugPrivilege	532	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe

description	pid	process	target process
PID 4544 wrote to memory of 2432	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe	Rbdt5d6H2hyRXEc.exe
PID 4544 wrote to memory of 2432	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe	Rbdt5d6H2hyRXEc.exe
PID 4544 wrote to memory of 2432	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe	Rbdt5d6H2hyRXEc.exe
PID 4544 wrote to memory of 532	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe	CTS.exe
PID 4544 wrote to memory of 532	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe	CTS.exe
PID 4544 wrote to memory of 532	4544	2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_9774d1051af0bec3277a17bfb4561c85_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544

C:\Users\Admin\AppData\Local\Temp\Rbdt5d6H2hyRXEc.exe
C:\Users\Admin\AppData\Local\Temp\Rbdt5d6H2hyRXEc.exe
2⤵
- Executes dropped EXE
PID:2432

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:532

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
392KB

MD5
bcfba06ce094ccac7846a555547116a2

SHA1
371508f031b618dc585ef1977be8197b443c2e84

SHA256
286b4c5b3afefddc28a0dd345bb5b5e1809a04767f2f5a44dacf89904c2d7f39

SHA512
65cee515c791280feab4d785228102e8e43a5ac78a7149e08b92d6f416f8304089cd26af60de9af23cc4f58dbf4085242c9b9832bbe82814839ff68fd77d59a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rbdt5d6H2hyRXEc.exe
Filesize
302KB

MD5
dc6992d10570b7c661b72beaf0e4d01b

SHA1
adb1372da4ae8ce3b986ded311c29a4f4710b297

SHA256
cb4ef161ac26390b31564a13a9f9646556cf959cc5f9a23326930e85545be783

SHA512
9fa021a4beef6e15564eff1334d8fff237ff69cda84cb04c391f8e172670a1d57798ea5eddd8c152f52468d79af1981efb3db7e83a53d9e8569b136eafe53e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rbdt5d6H2hyRXEc.exe
Filesize
231KB

MD5
022538483dc9f54cdbdc48a16899526c

SHA1
9b372370c29d2cdc72328bc680633212c6aa47fb

SHA256
b9d7fe7dcde0e386122ae04b0ffd3bf9dc7216b031826cfc32f7c6609e3da72d

SHA512
a0979c8779da3cb76d4d490fd9675ceeb516bdc697d2c1138f7ed36197d0e71aa0b036c3460a306f386e7140d09ce5aaec82f1fbcfe3839fcda7413e3badceb5

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
66df4ffab62e674af2e75b163563fc0b

SHA1
dec8a197312e41eeb3cfef01cb2a443f0205cd6e

SHA256
075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

SHA512
1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads