Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 04:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe
-
Size
669KB
-
MD5
694e6ab55ee159a15470fb0d483f566a
-
SHA1
ce3d1494e5819b6439d8bd9b48cf7ea9cf0dcd59
-
SHA256
44718da081ac1f1216740fc3cb21d29942be94448d8017e5b6390bebf93f55e2
-
SHA512
fe5db8e5794708cbe12024d4c72207ad5cb886c335e51468319a0faa71f80e863c199a103f18fe4ef5f81eceddcdf523e31eab903fb7c330a87c7813b983657d
-
SSDEEP
12288:SqVsecyI3d2Btvwi6EPabM9PT82fXv2KTwjQj2mAjoMiMBcQ3I2f:SqVsecyItyIi6EPabM9VfXU82Eza3d
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2860 dmkio4ah74xrahkies2zplkb.exe 2764 xzhbwvj.exe 2664 wsdxuxqy.exe 2720 xzhbwvj.exe -
Loads dropped DLL 6 IoCs
pid Process 2624 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe 2624 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe 2764 xzhbwvj.exe 2764 xzhbwvj.exe 2860 dmkio4ah74xrahkies2zplkb.exe 2860 dmkio4ah74xrahkies2zplkb.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\nyxeklpksucphw\iv6ag1g xzhbwvj.exe File created C:\Windows\nyxeklpksucphw\iv6ag1g wsdxuxqy.exe File created C:\Windows\nyxeklpksucphw\iv6ag1g xzhbwvj.exe File created C:\Windows\nyxeklpksucphw\iv6ag1g 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe File created C:\Windows\nyxeklpksucphw\iv6ag1g dmkio4ah74xrahkies2zplkb.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xzhbwvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wsdxuxqy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmkio4ah74xrahkies2zplkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2764 xzhbwvj.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe 2664 wsdxuxqy.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2860 2624 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe 30 PID 2624 wrote to memory of 2860 2624 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe 30 PID 2624 wrote to memory of 2860 2624 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe 30 PID 2624 wrote to memory of 2860 2624 2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe 30 PID 2764 wrote to memory of 2664 2764 xzhbwvj.exe 32 PID 2764 wrote to memory of 2664 2764 xzhbwvj.exe 32 PID 2764 wrote to memory of 2664 2764 xzhbwvj.exe 32 PID 2764 wrote to memory of 2664 2764 xzhbwvj.exe 32 PID 2860 wrote to memory of 2720 2860 dmkio4ah74xrahkies2zplkb.exe 33 PID 2860 wrote to memory of 2720 2860 dmkio4ah74xrahkies2zplkb.exe 33 PID 2860 wrote to memory of 2720 2860 dmkio4ah74xrahkies2zplkb.exe 33 PID 2860 wrote to memory of 2720 2860 dmkio4ah74xrahkies2zplkb.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-18_694e6ab55ee159a15470fb0d483f566a_bkransomware.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\nyxeklpksucphw\dmkio4ah74xrahkies2zplkb.exe"C:\nyxeklpksucphw\dmkio4ah74xrahkies2zplkb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\nyxeklpksucphw\xzhbwvj.exe"C:\nyxeklpksucphw\xzhbwvj.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2720
-
-
-
C:\nyxeklpksucphw\xzhbwvj.exeC:\nyxeklpksucphw\xzhbwvj.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\nyxeklpksucphw\wsdxuxqy.exefxv4uolq0ttp "c:\nyxeklpksucphw\xzhbwvj.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD539e1f64791cbacea18c01dc72c2961e2
SHA16103f6caee4d943f212c91eb37f87d9ce6fd10eb
SHA256b99fa0adc71a718165ce78df43cf9c81a36b0df16579937427b2152d89bd1a93
SHA512ebb50712e64dbe83bc6a711d0058a774eae153dde50482e6a3bfa206853d1d81c0b6c90cb8fd0a2b08e337cf1b96438da7f62e4a73dc71c852e63876a2a52a78
-
Filesize
669KB
MD5694e6ab55ee159a15470fb0d483f566a
SHA1ce3d1494e5819b6439d8bd9b48cf7ea9cf0dcd59
SHA25644718da081ac1f1216740fc3cb21d29942be94448d8017e5b6390bebf93f55e2
SHA512fe5db8e5794708cbe12024d4c72207ad5cb886c335e51468319a0faa71f80e863c199a103f18fe4ef5f81eceddcdf523e31eab903fb7c330a87c7813b983657d