Overview

overview

9

Static

static

3

2024-04-28...re.exe

windows7-x64

9

2024-04-28...re.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 18:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_9df4d4b113ddf408230f64ba34356bd8_bkransomware.exe

  • Size

    7.3MB

  • MD5

    9df4d4b113ddf408230f64ba34356bd8

  • SHA1

    4a09c79e88d12b398f450274a4344e1198b1eb80

  • SHA256

    9cc68cdaf4c118d16dd6cbf69b7bc2a8ad0096d9771291793dc8334d1e823119

  • SHA512

    dd8b403976534e4bd6534289c85b737ede27bc257358f0b90cfc56b1f1fdee55e720f1b008aefdcdce1c3fabc5de3d8b9b6c311474e1d7f74daf04e3cdc8b0b4

  • SSDEEP

    196608:RPlWiPvnO+fM/DnHtxuu/iO5MH0EtUD8quaXer7rhCqAU:RPlWiPvO+fEDHtxuIi0A1aXe7QU

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_9df4d4b113ddf408230f64ba34356bd8_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_9df4d4b113ddf408230f64ba34356bd8_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Users\Admin\AppData\Local\Temp\vwGn9BVMxoPOG4y.exe
      C:\Users\Admin\AppData\Local\Temp\vwGn9BVMxoPOG4y.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1344
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.backup
    Filesize

    809B

    MD5

    8b6737800745d3b99886d013b3392ac3

    SHA1

    bb94da3f294922d9e8d31879f2d145586a182e19

    SHA256

    86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

    SHA512

    654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log
    Filesize

    4KB

    MD5

    054fa571282db5ff923fb845efa1d374

    SHA1

    2da700de96e9e9cb0ea6de4eb5f8e11a0008d0ff

    SHA256

    3107d94c1f3d1249324bfe7c8ff9624cb1acdb92c32e106f34c7162526662023

    SHA512

    3f60196f60dd1d3c37d8acee43ed7da03672c9d673630f53250229bd54e35144eb1b118afd80930fc393b240b351edb1ee29a6e09dd1c769f202a5fc04170581

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe.ignore
    Filesize

    2B

    MD5

    81051bcc2cf1bedf378224b0a93e2877

    SHA1

    ba8ab5a0280b953aa97435ff8946cbcbb2755a27

    SHA256

    7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

    SHA512

    1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

    Download Submit
  • C:\Windows\CTS.exe
    Filesize

    71KB

    MD5

    f9d4ab0a726adc9b5e4b7d7b724912f1

    SHA1

    3d42ca2098475924f70ee4a831c4f003b4682328

    SHA256

    b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

    SHA512

    22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

    Download Submit
  • \Users\Admin\AppData\Local\Temp\vwGn9BVMxoPOG4y.exe
    Filesize

    7.3MB

    MD5

    dd6b75a77601d62ac66df1b0a51a7de3

    SHA1

    699fc35deccb0cd6e341420903fc993535c2c98f

    SHA256

    2f46a1d48e1589e0aa10f215e77cb48fb90c531e19aa3c05d766f59b449f3c15

    SHA512

    43bd57e5379c22494aade734a45a443722327d48c7f06aa521048c99adba576e29bd70bba7bd28ba94f8f24f88efed7b8e5a1b3249cbfcb4d95fd0bc1f424d86

    Download Submit
  • memory/1344-15-0x0000000000120000-0x0000000000866000-memory.dmp
    Filesize

    7.3MB

    Download
  • memory/1344-16-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1344-17-0x000000001AE30000-0x000000001AEB0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1344-25-0x000000001BF20000-0x000000001C202000-memory.dmp
    Filesize

    2.9MB

    Download
  • memory/1344-151-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp
    Filesize

    9.9MB

    Download