Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe
-
Size
495KB
-
MD5
f43374684559407e493fd741072a8edf
-
SHA1
8da3021d3e6e08df3d8b598f9be9f4e67b8d7e1e
-
SHA256
375e3f7b3745c3ba36dcfdb9c3a87c057f4d58cfc02be4437fd559d8f55b78de
-
SHA512
15c756a77a13dec2d7f2dcaa0e8b3536202091445dd9aec9883f982aace048a098336ed5223b21b47cd408ab6ed073cb9e393fd647c90a7678e1749cc2a539ed
-
SSDEEP
12288:aGZePlhd9jksHuecbf2AbcTgKixu0oW5FMyba:fZePd9cbf2D0rnoeFM
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1604 mkm4agv5rtcperp0b.exe 2896 vbjzwprpnwi.exe 2108 ckzukbjgyj.exe 2796 vbjzwprpnwi.exe -
Loads dropped DLL 5 IoCs
pid Process 2272 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe 2272 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe 2896 vbjzwprpnwi.exe 2896 vbjzwprpnwi.exe 1604 mkm4agv5rtcperp0b.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\dnrjqfhqjczukkp\gsndrqvl vbjzwprpnwi.exe File created C:\Windows\dnrjqfhqjczukkp\gsndrqvl ckzukbjgyj.exe File created C:\Windows\dnrjqfhqjczukkp\gsndrqvl vbjzwprpnwi.exe File created C:\Windows\dnrjqfhqjczukkp\gsndrqvl 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe File created C:\Windows\dnrjqfhqjczukkp\gsndrqvl mkm4agv5rtcperp0b.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mkm4agv5rtcperp0b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjzwprpnwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ckzukbjgyj.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2896 vbjzwprpnwi.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe 2108 ckzukbjgyj.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1604 2272 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe 31 PID 2272 wrote to memory of 1604 2272 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe 31 PID 2272 wrote to memory of 1604 2272 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe 31 PID 2272 wrote to memory of 1604 2272 2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe 31 PID 2896 wrote to memory of 2108 2896 vbjzwprpnwi.exe 33 PID 2896 wrote to memory of 2108 2896 vbjzwprpnwi.exe 33 PID 2896 wrote to memory of 2108 2896 vbjzwprpnwi.exe 33 PID 2896 wrote to memory of 2108 2896 vbjzwprpnwi.exe 33 PID 1604 wrote to memory of 2796 1604 mkm4agv5rtcperp0b.exe 34 PID 1604 wrote to memory of 2796 1604 mkm4agv5rtcperp0b.exe 34 PID 1604 wrote to memory of 2796 1604 mkm4agv5rtcperp0b.exe 34 PID 1604 wrote to memory of 2796 1604 mkm4agv5rtcperp0b.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_f43374684559407e493fd741072a8edf_bkransomware.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\dnrjqfhqjczukkp\mkm4agv5rtcperp0b.exe"C:\dnrjqfhqjczukkp\mkm4agv5rtcperp0b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\dnrjqfhqjczukkp\vbjzwprpnwi.exe"C:\dnrjqfhqjczukkp\vbjzwprpnwi.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2796
-
-
-
C:\dnrjqfhqjczukkp\vbjzwprpnwi.exeC:\dnrjqfhqjczukkp\vbjzwprpnwi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\dnrjqfhqjczukkp\ckzukbjgyj.exepqbsgcnpm1tn "c:\dnrjqfhqjczukkp\vbjzwprpnwi.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10B
MD52c84809b0d8c1ff20a44a9f2f3daa787
SHA1c95b1cc8de4adf835261207d4e77e1f2fb7ce900
SHA25669156a9c0ee82b97338d7058d27d120d975273b58861cd98cc53fbfe53de92ad
SHA512ac6a82284b4d4d5873500521a5c945b2754a6198a0b86367e76f4cbd3f2bc5570a7f79553c80060c59b62588238049f870463e3b840d91158622e428c085195b
-
Filesize
495KB
MD5f43374684559407e493fd741072a8edf
SHA18da3021d3e6e08df3d8b598f9be9f4e67b8d7e1e
SHA256375e3f7b3745c3ba36dcfdb9c3a87c057f4d58cfc02be4437fd559d8f55b78de
SHA51215c756a77a13dec2d7f2dcaa0e8b3536202091445dd9aec9883f982aace048a098336ed5223b21b47cd408ab6ed073cb9e393fd647c90a7678e1749cc2a539ed