Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 04:25
General
-
Target
2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe
-
Size
605KB
-
MD5
48853dfe2f0fa5f286ea3ce79b0bd8e9
-
SHA1
8f790cee95d4e8f381de8683c6741bccceeb1c00
-
SHA256
56f6d974faf55d01a6cbbf60a51ac8371d7767c48e1a64d3a8b4df7de33ac0c0
-
SHA512
b422751c2a88386f893365fcbb0a23514cd6f7caf64fb8d145de747976219c34e763da2f39c5ede015bde7428656e652c09cfd995710e13fcd665493e496dc30
-
SSDEEP
12288:iglxRWu6mP8PCu//eL/Q+AlcKChmILFzRj:igNP6mS4/xocKOpFFj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Drops file in Windows directory 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_48853dfe2f0fa5f286ea3ce79b0bd8e9_bkransomware.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\cmrfcvxgqcp\ic3z9enkdveaaert.exe"C:\cmrfcvxgqcp\ic3z9enkdveaaert.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\cmrfcvxgqcp\vwwwkxdkuetd.exe"C:\cmrfcvxgqcp\vwwwkxdkuetd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\cmrfcvxgqcp\vwwwkxdkuetd.exeC:\cmrfcvxgqcp\vwwwkxdkuetd.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\cmrfcvxgqcp\nnzggcbdmpfb.exemxdxacgmdrja "c:\cmrfcvxgqcp\vwwwkxdkuetd.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
605KB
MD548853dfe2f0fa5f286ea3ce79b0bd8e9
SHA18f790cee95d4e8f381de8683c6741bccceeb1c00
SHA25656f6d974faf55d01a6cbbf60a51ac8371d7767c48e1a64d3a8b4df7de33ac0c0
SHA512b422751c2a88386f893365fcbb0a23514cd6f7caf64fb8d145de747976219c34e763da2f39c5ede015bde7428656e652c09cfd995710e13fcd665493e496dc30
-
Filesize
4B
MD548ff889d5464c3b2d1e7e04c2af44177
SHA15960cd5097430ab524f8137b74d5f88abbcf628b
SHA256ca6091e62507d74e532ad30751a9ea6fd36e8ff360cab27fd627b169c52b0151
SHA512d34e67968e273fc1e6d577dd26bcf3a1c38d2a5835e6b94aed4ac0c7b2dd9ee4452ee95178586d7dd2b09c59677e5cad678c0bab89e812f395819fbd034e8abd
-
Filesize
6B
MD50606d42b5c965742ca0ff915ddc96720
SHA1720c3fb94349a7f83b43c80a90edf9b48c0583f1
SHA256cd84eed2d1a54a83dc8ab4c88c2ee0ff2b7107d87229573da52091af803adcfb
SHA512515b589e29ded5a28e9d04cbb19e86725afa27a02eca11d5dbb773a539a070e5608c5fdffa6219273a3d829dbd0d5ec39b9e6c4c3bf948a9db834c4d2c50e502