Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 04:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe
-
Size
505KB
-
MD5
fd2c206ec409c1ea115d1201937e0542
-
SHA1
34c45c41f2614998d2296afb526a88b71291da1a
-
SHA256
590b120a787551204f4ca360f55d3df44ec80d6e825c919060ebac12f6516a23
-
SHA512
ad05b7a50b56c3f2a7341e6ef717672249bbf6c153692e22b68f40fbbc29d173c3927e1642382d7b8f9f71cea7ecdaec7f998526a3679683e7ab105afc1a2c45
-
SSDEEP
12288:6+5CVhXPwrrdDnW297nOMMgfwrqZ3fiH63VXzFB+04:6++hXPwPda2pzwrm3fz3Vxg
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2956 fmztz4aga5lohhssmsmsco5.exe 2516 lmmuxoea.exe 2864 dskfczrpea.exe 2456 lmmuxoea.exe -
Loads dropped DLL 6 IoCs
pid Process 2752 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe 2752 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe 2516 lmmuxoea.exe 2516 lmmuxoea.exe 2956 fmztz4aga5lohhssmsmsco5.exe 2956 fmztz4aga5lohhssmsmsco5.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\hxedzioeihdpia\x4bzec3wwc 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe File created C:\Windows\hxedzioeihdpia\x4bzec3wwc fmztz4aga5lohhssmsmsco5.exe File created C:\Windows\hxedzioeihdpia\x4bzec3wwc lmmuxoea.exe File created C:\Windows\hxedzioeihdpia\x4bzec3wwc dskfczrpea.exe File created C:\Windows\hxedzioeihdpia\x4bzec3wwc lmmuxoea.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2516 lmmuxoea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe 2864 dskfczrpea.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2956 2752 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe 30 PID 2752 wrote to memory of 2956 2752 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe 30 PID 2752 wrote to memory of 2956 2752 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe 30 PID 2752 wrote to memory of 2956 2752 2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe 30 PID 2516 wrote to memory of 2864 2516 lmmuxoea.exe 32 PID 2516 wrote to memory of 2864 2516 lmmuxoea.exe 32 PID 2516 wrote to memory of 2864 2516 lmmuxoea.exe 32 PID 2516 wrote to memory of 2864 2516 lmmuxoea.exe 32 PID 2956 wrote to memory of 2456 2956 fmztz4aga5lohhssmsmsco5.exe 33 PID 2956 wrote to memory of 2456 2956 fmztz4aga5lohhssmsmsco5.exe 33 PID 2956 wrote to memory of 2456 2956 fmztz4aga5lohhssmsmsco5.exe 33 PID 2956 wrote to memory of 2456 2956 fmztz4aga5lohhssmsmsco5.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_fd2c206ec409c1ea115d1201937e0542_bkransomware.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\hxedzioeihdpia\fmztz4aga5lohhssmsmsco5.exe"C:\hxedzioeihdpia\fmztz4aga5lohhssmsmsco5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\hxedzioeihdpia\lmmuxoea.exe"C:\hxedzioeihdpia\lmmuxoea.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2456
-
-
-
C:\hxedzioeihdpia\lmmuxoea.exeC:\hxedzioeihdpia\lmmuxoea.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\hxedzioeihdpia\dskfczrpea.exexu87yvznkkos "c:\hxedzioeihdpia\lmmuxoea.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6B
MD5483a3c69bbf22d9b97fdced13a618eee
SHA17cf720defcdbd8d9e204c0952ef1373034a10e1c
SHA256dd4cdfdf4c6d021fbe9c019a7c84508135927e7e4512c99f37bf359244212e50
SHA5120b79b3ee6ad4350c98844eaf80fc1f445f9a240b16996ae69cbde459d760a7834f2e1e8fe03c496672d98d89df65042eadf698c4dbadda186c798f31a0dc38a8
-
Filesize
505KB
MD5fd2c206ec409c1ea115d1201937e0542
SHA134c45c41f2614998d2296afb526a88b71291da1a
SHA256590b120a787551204f4ca360f55d3df44ec80d6e825c919060ebac12f6516a23
SHA512ad05b7a50b56c3f2a7341e6ef717672249bbf6c153692e22b68f40fbbc29d173c3927e1642382d7b8f9f71cea7ecdaec7f998526a3679683e7ab105afc1a2c45