Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 04:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe
-
Size
474KB
-
MD5
1276884ab8b38dff7e5bd8c9d09abb86
-
SHA1
641bd14f7b4c8ab1d91802e4447237648b105413
-
SHA256
b7e9b9ff4aa555f867ea882b97ffab7d784d08795bf75466949ea532069c8dae
-
SHA512
10e905563bdfdfc4740dc75c83887b4f9db8e4b4b6f32085db1a3a40fd0a1e199865fb3a5888ca5d14d399b7f9a19c70d6c0f3c7675a80ab41273068dd947fa7
-
SSDEEP
6144:mKbx6kSnn7dI+pxxOXVZyowEZiOk8onksSodA2+C1BUfP7nlFeRDlObv3MILD:myEnn7++f4FwCihnwJCfG7nXeRyMAD
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2652 aw3z8tdiymeun1rimw.exe 2932 ckbqezf.exe 4660 hmhiuzjysci.exe 4884 ckbqezf.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\svvdvawojiq\nhtjczj 2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe File created C:\Windows\svvdvawojiq\nhtjczj aw3z8tdiymeun1rimw.exe File created C:\Windows\svvdvawojiq\nhtjczj ckbqezf.exe File created C:\Windows\svvdvawojiq\nhtjczj hmhiuzjysci.exe File created C:\Windows\svvdvawojiq\nhtjczj ckbqezf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 ckbqezf.exe 2932 ckbqezf.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe 4660 hmhiuzjysci.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4380 wrote to memory of 2652 4380 2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe 80 PID 4380 wrote to memory of 2652 4380 2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe 80 PID 4380 wrote to memory of 2652 4380 2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe 80 PID 2932 wrote to memory of 4660 2932 ckbqezf.exe 82 PID 2932 wrote to memory of 4660 2932 ckbqezf.exe 82 PID 2932 wrote to memory of 4660 2932 ckbqezf.exe 82 PID 2652 wrote to memory of 4884 2652 aw3z8tdiymeun1rimw.exe 83 PID 2652 wrote to memory of 4884 2652 aw3z8tdiymeun1rimw.exe 83 PID 2652 wrote to memory of 4884 2652 aw3z8tdiymeun1rimw.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_1276884ab8b38dff7e5bd8c9d09abb86_bkransomware.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\svvdvawojiq\aw3z8tdiymeun1rimw.exe"C:\svvdvawojiq\aw3z8tdiymeun1rimw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\svvdvawojiq\ckbqezf.exe"C:\svvdvawojiq\ckbqezf.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4884
-
-
-
C:\svvdvawojiq\ckbqezf.exeC:\svvdvawojiq\ckbqezf.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\svvdvawojiq\hmhiuzjysci.exepkec4gg4myex "c:\svvdvawojiq\ckbqezf.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
474KB
MD51276884ab8b38dff7e5bd8c9d09abb86
SHA1641bd14f7b4c8ab1d91802e4447237648b105413
SHA256b7e9b9ff4aa555f867ea882b97ffab7d784d08795bf75466949ea532069c8dae
SHA51210e905563bdfdfc4740dc75c83887b4f9db8e4b4b6f32085db1a3a40fd0a1e199865fb3a5888ca5d14d399b7f9a19c70d6c0f3c7675a80ab41273068dd947fa7
-
Filesize
11B
MD5c57522b5a7e89c34353278cd58edffa4
SHA1f8579ddcd55f77b4149677f435f08061ae744052
SHA25627222e8868db41310262feab1f0ef13da79cd15fe86485c175ee6448019ebc65
SHA512283728cd18acc951c8be0accc82c2ff99798a6d5cf29c0fc360fc257f0a67bc22df4cd665f8f852c01fc61946afa31a2e1a7b1259a157e79f31237aea21464f0