Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe
-
Size
605KB
-
MD5
48853dfe2f0fa5f286ea3ce79b0bd8e9
-
SHA1
8f790cee95d4e8f381de8683c6741bccceeb1c00
-
SHA256
56f6d974faf55d01a6cbbf60a51ac8371d7767c48e1a64d3a8b4df7de33ac0c0
-
SHA512
b422751c2a88386f893365fcbb0a23514cd6f7caf64fb8d145de747976219c34e763da2f39c5ede015bde7428656e652c09cfd995710e13fcd665493e496dc30
-
SSDEEP
12288:iglxRWu6mP8PCu//eL/Q+AlcKChmILFzRj:igNP6mS4/xocKOpFFj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2956 ic4agvnydveaaert.exe 380 vwwwkxdkuetd.exe 2640 nnzggcbdmpfb.exe 2808 vwwwkxdkuetd.exe -
Loads dropped DLL 6 IoCs
pid Process 2192 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe 2192 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe 380 vwwwkxdkuetd.exe 380 vwwwkxdkuetd.exe 2956 ic4agvnydveaaert.exe 2956 ic4agvnydveaaert.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\cmrfcvxgqcp\rbzjibotruw 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe File created C:\Windows\cmrfcvxgqcp\rbzjibotruw ic4agvnydveaaert.exe File created C:\Windows\cmrfcvxgqcp\rbzjibotruw vwwwkxdkuetd.exe File created C:\Windows\cmrfcvxgqcp\rbzjibotruw nnzggcbdmpfb.exe File created C:\Windows\cmrfcvxgqcp\rbzjibotruw vwwwkxdkuetd.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vwwwkxdkuetd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnzggcbdmpfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ic4agvnydveaaert.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 380 vwwwkxdkuetd.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe 2640 nnzggcbdmpfb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2956 2192 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe 31 PID 2192 wrote to memory of 2956 2192 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe 31 PID 2192 wrote to memory of 2956 2192 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe 31 PID 2192 wrote to memory of 2956 2192 2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe 31 PID 380 wrote to memory of 2640 380 vwwwkxdkuetd.exe 33 PID 380 wrote to memory of 2640 380 vwwwkxdkuetd.exe 33 PID 380 wrote to memory of 2640 380 vwwwkxdkuetd.exe 33 PID 380 wrote to memory of 2640 380 vwwwkxdkuetd.exe 33 PID 2956 wrote to memory of 2808 2956 ic4agvnydveaaert.exe 34 PID 2956 wrote to memory of 2808 2956 ic4agvnydveaaert.exe 34 PID 2956 wrote to memory of 2808 2956 ic4agvnydveaaert.exe 34 PID 2956 wrote to memory of 2808 2956 ic4agvnydveaaert.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\cmrfcvxgqcp\ic4agvnydveaaert.exe"C:\cmrfcvxgqcp\ic4agvnydveaaert.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\cmrfcvxgqcp\vwwwkxdkuetd.exe"C:\cmrfcvxgqcp\vwwwkxdkuetd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2808
-
-
-
C:\cmrfcvxgqcp\vwwwkxdkuetd.exeC:\cmrfcvxgqcp\vwwwkxdkuetd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:380 -
C:\cmrfcvxgqcp\nnzggcbdmpfb.exemxdxacgmdrja "c:\cmrfcvxgqcp\vwwwkxdkuetd.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6B
MD50606d42b5c965742ca0ff915ddc96720
SHA1720c3fb94349a7f83b43c80a90edf9b48c0583f1
SHA256cd84eed2d1a54a83dc8ab4c88c2ee0ff2b7107d87229573da52091af803adcfb
SHA512515b589e29ded5a28e9d04cbb19e86725afa27a02eca11d5dbb773a539a070e5608c5fdffa6219273a3d829dbd0d5ec39b9e6c4c3bf948a9db834c4d2c50e502
-
Filesize
605KB
MD548853dfe2f0fa5f286ea3ce79b0bd8e9
SHA18f790cee95d4e8f381de8683c6741bccceeb1c00
SHA25656f6d974faf55d01a6cbbf60a51ac8371d7767c48e1a64d3a8b4df7de33ac0c0
SHA512b422751c2a88386f893365fcbb0a23514cd6f7caf64fb8d145de747976219c34e763da2f39c5ede015bde7428656e652c09cfd995710e13fcd665493e496dc30