f26909d144960bc463cffb7bbf7df0ff462fb12dbde493952c47d769387bd265

General

Target

2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe
Size

567KB
MD5

c7d500ecb6dc0bb52d24b1fdd44f4cd0
SHA1

fa0f6591e6e008362cd223a1171d012a9b6e026c
SHA256

f26909d144960bc463cffb7bbf7df0ff462fb12dbde493952c47d769387bd265
SHA512

fe483e612c4dd26961a23a56b516d839e64003f663a8623c239c5aa41dc2ff05f4c57768db750a4c5264d2565df9ebb745625f2226473f48908742223a9982a8
SSDEEP

12288:vrr6aklX/I+nYKJBcpnwuUeEjtlTVY/uYS0QOhB4j:zrE5/IFecpnwuUzJfkuY7+j

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

g9t4agatusp8m6nmalnyht.exeycsrfxdu.exeeglrhrkl.exe

pid process

2720 g9t4agatusp8m6nmalnyht.exe
2616 ycsrfxdu.exe
2608 eglrhrkl.exe

pid	process
2720	g9t4agatusp8m6nmalnyht.exe
2616	ycsrfxdu.exe
2608	eglrhrkl.exe

Loads dropped DLL 6 IoCs

Processes:

2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exeg9t4agatusp8m6nmalnyht.exeycsrfxdu.exe

pid	process
2872	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe
2872	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe
2720	g9t4agatusp8m6nmalnyht.exe
2720	g9t4agatusp8m6nmalnyht.exe
2616	ycsrfxdu.exe
2616	ycsrfxdu.exe

Drops file in Windows directory 4 IoCs

Processes:

eglrhrkl.exe2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exeg9t4agatusp8m6nmalnyht.exeycsrfxdu.exe

description	ioc	process
File created	C:\Windows\apgajmopnialy\vzrfqproldb	eglrhrkl.exe
File created	C:\Windows\apgajmopnialy\vzrfqproldb	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe
File created	C:\Windows\apgajmopnialy\vzrfqproldb	g9t4agatusp8m6nmalnyht.exe
File created	C:\Windows\apgajmopnialy\vzrfqproldb	ycsrfxdu.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exeg9t4agatusp8m6nmalnyht.exeycsrfxdu.exeeglrhrkl.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g9t4agatusp8m6nmalnyht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycsrfxdu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eglrhrkl.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ycsrfxdu.exeeglrhrkl.exe

pid	process
2616	ycsrfxdu.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe
2608	eglrhrkl.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exeg9t4agatusp8m6nmalnyht.exeycsrfxdu.exe

description	pid	process	target process
PID 2872 wrote to memory of 2720	2872	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe	g9t4agatusp8m6nmalnyht.exe
PID 2872 wrote to memory of 2720	2872	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe	g9t4agatusp8m6nmalnyht.exe
PID 2872 wrote to memory of 2720	2872	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe	g9t4agatusp8m6nmalnyht.exe
PID 2872 wrote to memory of 2720	2872	2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe	g9t4agatusp8m6nmalnyht.exe
PID 2720 wrote to memory of 2616	2720	g9t4agatusp8m6nmalnyht.exe	ycsrfxdu.exe
PID 2720 wrote to memory of 2616	2720	g9t4agatusp8m6nmalnyht.exe	ycsrfxdu.exe
PID 2720 wrote to memory of 2616	2720	g9t4agatusp8m6nmalnyht.exe	ycsrfxdu.exe
PID 2720 wrote to memory of 2616	2720	g9t4agatusp8m6nmalnyht.exe	ycsrfxdu.exe
PID 2616 wrote to memory of 2608	2616	ycsrfxdu.exe	eglrhrkl.exe
PID 2616 wrote to memory of 2608	2616	ycsrfxdu.exe	eglrhrkl.exe
PID 2616 wrote to memory of 2608	2616	ycsrfxdu.exe	eglrhrkl.exe
PID 2616 wrote to memory of 2608	2616	ycsrfxdu.exe	eglrhrkl.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-27_c7d500ecb6dc0bb52d24b1fdd44f4cd0_bkransomware.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872

C:\apgajmopnialy\g9t4agatusp8m6nmalnyht.exe
"C:\apgajmopnialy\g9t4agatusp8m6nmalnyht.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720

C:\apgajmopnialy\ycsrfxdu.exe
"C:\apgajmopnialy\ycsrfxdu.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616

C:\apgajmopnialy\eglrhrkl.exe
g2dcirczqqxe "c:\apgajmopnialy\ycsrfxdu.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\apgajmopnialy\vzrfqproldb

Filesize
6B

MD5
3bdca3ddf07ec24124d3fea172f2aae5

SHA1
99b55c0af2c32edc6ac5ffa5be69d55d43d669bd

SHA256
95c27e1412ade0eadc8b7ac9dd3e431b730481f5d98588d784a18fbc1bb86d81

SHA512
e37915c632d6fd5fd39d761efe23531a1ce6cc6e05ed2d0cf74341e5c8bd7924b8dc22381fe12671223a40b01793d3e1c60c1eebf80d75461b28eab747d2c81b

Download Submit
\apgajmopnialy\g9t4agatusp8m6nmalnyht.exe

Filesize
567KB

MD5
c7d500ecb6dc0bb52d24b1fdd44f4cd0

SHA1
fa0f6591e6e008362cd223a1171d012a9b6e026c

SHA256
f26909d144960bc463cffb7bbf7df0ff462fb12dbde493952c47d769387bd265

SHA512
fe483e612c4dd26961a23a56b516d839e64003f663a8623c239c5aa41dc2ff05f4c57768db750a4c5264d2565df9ebb745625f2226473f48908742223a9982a8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads