e93f49fec8afb975008ba45daabfc5206895f4804dd7723cb78a213955e8e984

General

Target
2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe
Size 208KB
Sample240807-eh5tdatflc
SHA256 e93f49fec8afb975008ba45daabfc5206895f4804dd7723cb78a213955e8e984
MD5 810f83d30d42576ffb5693b191534b47
SHA1 22ac1aa42a42a7cb2b6458500aae83f065ef4b78
SHA512 9eff5855aa7ac7e4987f35bd0cbabb7213d687eb97a7a5a5afdec679386b644e5c5fc64719714291799e1bf7b998ee68773c8ef49673eeef85cfda89fdf5d4cc
SSDEEP 3072:ZhpAyazIlyazTp4+DvspA5+wjIdhTE3XFfbnYxvGzNN0BMPaWSQK5NxVXzk67:hZMazyixYw08HFW+LdPaWSQuzk67
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3448	fHiT3O0BkzQOszv.exe
232	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fHiT3O0BkzQOszv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe
Token: SeDebugPrivilege	232	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3448	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe	83
PID 1640 wrote to memory of 3448	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe	83
PID 1640 wrote to memory of 3448	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe	83
PID 1640 wrote to memory of 232	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe	84
PID 1640 wrote to memory of 232	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe	84
PID 1640 wrote to memory of 232	1640	2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-07_810f83d30d42576ffb5693b191534b47_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\fHiT3O0BkzQOszv.exe
  C:\Users\Admin\AppData\Local\Temp\fHiT3O0BkzQOszv.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 392KB
SHA256 4b81a9d942325a41d1d4618bb57c932a4fb00894a86695952733075b74fb5211
MD5 48ef060e9b7ecae24ea05c8d8bde8ac8
SHA1 c2d585e83c7e37d2d8e33c092e28b652215ac05a
SHA512 4c34a99e2fbeb67ddb8574fe02052006704420f7cfed80127491fe6fd48679505e98d5c3ae11809be02fa63306ddeaa78ecb46e21b0ed88bc6f2f3d742de5a85
SSDEEP 6144:hZMazE+xlM+xZgf9vxpJxqIuwGEovMM7+mjtRzjephrJYGLnHKTPiC:hS03lMyZg1uXEovMM7j3EhrWGWTKC
MD5 SHA1 SHA512 SSDEEP

Submit Download

fHiT3O0BkzQOszv.exe

Path C:\Users\Admin\AppData\Local\Temp\fHiT3O0BkzQOszv.exe
Size 137KB
SHA256 9efdf94d2ec05d3dad9b39c06f98038d1d407385eff5629ba8d7a920be18da8e
MD5 32b8ad6eca9094891e792631baea9717
SHA1 5536b7532400baf27beb2bfd425159264ad71136
SHA512 a175012b243f118eab0f571beea874503403cec1d080def788a45d36c2cb94515f8c1e278da410d07040c89d8a344e4fba98c40a9bdef7480c7ab33354fbfeba
SSDEEP 3072:xZLWfp2KkvL5kdnQrWLuzeHpl18fCtnRPF9EVnb43jaI5gr/uH:/gkSdQ6mCtnRPF9cCGr/uH
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
MD5 66df4ffab62e674af2e75b163563fc0b
SHA1 dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA512 1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazT:ZhpAyazIlyazT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads