75352a45b67b3a7f91e237cc5dc2de79f52e0e13b81fe10e289199477f2d46c9

General

Target

kins_1.0.0.2.vir.exe
Size

308KB
MD5

fcfe12b0e6d1ff5692e6f8f40f888b26
SHA1

176e99634eb509404b4e1d0b8fa2f031ceb7fdaf
SHA256

75352a45b67b3a7f91e237cc5dc2de79f52e0e13b81fe10e289199477f2d46c9
SHA512

41e8392282c3e7e21a1edaa0eb7f0b04459043f2181f406bf51a14f594ab92b46cb20f0220b4f8f3041132caf60351474500c904344a962ddf67f98ac2df190a

Score

8^/10

evasion trojan persistence

Malware Config

Signatures

NTFS ADS 1 IoCs

Processes:

WinMail.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\3BF147E2-00000001.eml:OECustomProperty	WinMail.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

kins_1.0.0.2.vir.exeWinMail.exe

description pid process

Token: SeSecurityPrivilege 1416 kins_1.0.0.2.vir.exe
Token: SeManageVolumePrivilege 1032 WinMail.exe

description	pid	process
Token: SeSecurityPrivilege	1416	kins_1.0.0.2.vir.exe
Token: SeManageVolumePrivilege	1032	WinMail.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

kins_1.0.0.2.vir.exeipat.exeexplorer.exe

description	pid	process	target process
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	ipat.exe
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	ipat.exe
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	ipat.exe
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	ipat.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1092 wrote to memory of 1592	1092	ipat.exe	explorer.exe
PID 1592 wrote to memory of 1072	1592	explorer.exe	taskhost.exe
PID 1592 wrote to memory of 1072	1592	explorer.exe	taskhost.exe
PID 1592 wrote to memory of 1072	1592	explorer.exe	taskhost.exe
PID 1592 wrote to memory of 1072	1592	explorer.exe	taskhost.exe
PID 1592 wrote to memory of 1072	1592	explorer.exe	taskhost.exe
PID 1592 wrote to memory of 1160	1592	explorer.exe	Dwm.exe
PID 1592 wrote to memory of 1160	1592	explorer.exe	Dwm.exe
PID 1592 wrote to memory of 1160	1592	explorer.exe	Dwm.exe
PID 1592 wrote to memory of 1160	1592	explorer.exe	Dwm.exe
PID 1592 wrote to memory of 1160	1592	explorer.exe	Dwm.exe
PID 1592 wrote to memory of 1212	1592	explorer.exe	Explorer.EXE
PID 1592 wrote to memory of 1212	1592	explorer.exe	Explorer.EXE
PID 1592 wrote to memory of 1212	1592	explorer.exe	Explorer.EXE
PID 1592 wrote to memory of 1212	1592	explorer.exe	Explorer.EXE
PID 1592 wrote to memory of 1212	1592	explorer.exe	Explorer.EXE
PID 1592 wrote to memory of 1416	1592	explorer.exe	kins_1.0.0.2.vir.exe
PID 1592 wrote to memory of 1416	1592	explorer.exe	kins_1.0.0.2.vir.exe
PID 1592 wrote to memory of 1416	1592	explorer.exe	kins_1.0.0.2.vir.exe
PID 1592 wrote to memory of 1416	1592	explorer.exe	kins_1.0.0.2.vir.exe
PID 1592 wrote to memory of 1416	1592	explorer.exe	kins_1.0.0.2.vir.exe
PID 1092 wrote to memory of 1032	1092	ipat.exe	WinMail.exe
PID 1092 wrote to memory of 1032	1092	ipat.exe	WinMail.exe
PID 1092 wrote to memory of 1032	1092	ipat.exe	WinMail.exe
PID 1092 wrote to memory of 1032	1092	ipat.exe	WinMail.exe
PID 1092 wrote to memory of 1032	1092	ipat.exe	WinMail.exe
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	cmd.exe
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	cmd.exe
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	cmd.exe
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	cmd.exe
PID 1592 wrote to memory of 1128	1592	explorer.exe	cmd.exe
PID 1592 wrote to memory of 1128	1592	explorer.exe	cmd.exe
PID 1592 wrote to memory of 1128	1592	explorer.exe	cmd.exe
PID 1592 wrote to memory of 1128	1592	explorer.exe	cmd.exe
PID 1592 wrote to memory of 1128	1592	explorer.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

ipat.exe

pid process

1092 ipat.exe

pid	process
1092	ipat.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

explorer.exeipat.exe

pid	process
1592	explorer.exe
1092	ipat.exe
1092	ipat.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

WinMail.exe

pid process

1032 WinMail.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe
Loads dropped DLL 1 IoCs

Processes:

kins_1.0.0.2.vir.exe

pid process

1416 kins_1.0.0.2.vir.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinMail.exe

pid process

1032 WinMail.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1128 cmd.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

WinMail.exe

pid process

1032 WinMail.exe

pid	process
1032	WinMail.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

pid	process
1416	kins_1.0.0.2.vir.exe

pid	process
1032	WinMail.exe

pid	process
1128	cmd.exe

pid	process
1032	WinMail.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\ipat.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Ceavx\\ipat.exe"	explorer.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1072

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.2.vir.exe
"C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.2.vir.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1416

C:\Users\Admin\AppData\Roaming\Ceavx\ipat.exe
"C:\Users\Admin\AppData\Roaming\Ceavx\ipat.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1092

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- Adds Run key to start application
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcceb785b.bat"
3⤵
- Deletes itself
PID:1128

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpcceb785b.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Ceavx\ipat.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Ceavx\ipat.exe

Download Submit
\Users\Admin\AppData\Roaming\Ceavx\ipat.exe

Download Submit
memory/1032-29-0x00000000041C0000-0x00000000041C2000-memory.dmp

Filesize
8KB

Download
memory/1032-53-0x0000000002130000-0x0000000002140000-memory.dmp

Filesize
64KB

Download
memory/1032-7-0x0000000003910000-0x0000000003B10000-memory.dmp

Filesize
2.0MB

Download
memory/1032-31-0x00000000042F0000-0x00000000042F2000-memory.dmp

Filesize
8KB

Download
memory/1032-10-0x0000000003910000-0x0000000003B10000-memory.dmp

Filesize
2.0MB

Download
memory/1032-11-0x0000000003A10000-0x0000000003B10000-memory.dmp

Filesize
1024KB

Download
memory/1032-15-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1032-16-0x0000000002650000-0x0000000002652000-memory.dmp

Filesize
8KB

Download
memory/1032-17-0x0000000002670000-0x0000000002672000-memory.dmp

Filesize
8KB

Download
memory/1032-18-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1032-19-0x0000000003D70000-0x0000000003D72000-memory.dmp

Filesize
8KB

Download
memory/1032-20-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1032-21-0x0000000003C50000-0x0000000003C52000-memory.dmp

Filesize
8KB

Download
memory/1032-59-0x00000000020D0000-0x00000000020E0000-memory.dmp

Filesize
64KB

Download
memory/1032-32-0x0000000004400000-0x0000000004402000-memory.dmp

Filesize
8KB

Download
memory/1032-51-0x0000000003910000-0x0000000003A10000-memory.dmp

Filesize
1024KB

Download
memory/1032-25-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1032-33-0x00000000043C0000-0x00000000043C2000-memory.dmp

Filesize
8KB

Download
memory/1032-27-0x0000000004170000-0x0000000004172000-memory.dmp

Filesize
8KB

Download
memory/1032-28-0x00000000042D0000-0x00000000042D2000-memory.dmp

Filesize
8KB

Download
memory/1032-50-0x0000000004C90000-0x0000000004C92000-memory.dmp

Filesize
8KB

Download
memory/1032-30-0x00000000042E0000-0x00000000042E2000-memory.dmp

Filesize
8KB

Download
memory/1032-9-0x0000000003910000-0x0000000003A10000-memory.dmp

Filesize
1024KB

Download
memory/1032-5-0x0000000003910000-0x0000000003A10000-memory.dmp

Filesize
1024KB

Download
memory/1032-26-0x0000000003F10000-0x0000000003F12000-memory.dmp

Filesize
8KB

Download
memory/1032-34-0x0000000004410000-0x0000000004412000-memory.dmp

Filesize
8KB

Download
memory/1032-35-0x00000000043B0000-0x00000000043B2000-memory.dmp

Filesize
8KB

Download
memory/1032-36-0x0000000004690000-0x0000000004692000-memory.dmp

Filesize
8KB

Download
memory/1032-37-0x00000000043A0000-0x00000000043A2000-memory.dmp

Filesize
8KB

Download
memory/1032-38-0x00000000046A0000-0x00000000046A2000-memory.dmp

Filesize
8KB

Download
memory/1032-39-0x0000000004390000-0x0000000004392000-memory.dmp

Filesize
8KB

Download
memory/1032-40-0x0000000004B70000-0x0000000004B72000-memory.dmp

Filesize
8KB

Download
memory/1032-41-0x0000000004380000-0x0000000004382000-memory.dmp

Filesize
8KB

Download
memory/1032-42-0x0000000004B80000-0x0000000004B82000-memory.dmp

Filesize
8KB

Download
memory/1032-43-0x0000000004B90000-0x0000000004B92000-memory.dmp

Filesize
8KB

Download
memory/1032-44-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/1032-45-0x0000000004BA0000-0x0000000004BA2000-memory.dmp

Filesize
8KB

Download
memory/1032-46-0x0000000003B40000-0x0000000003B42000-memory.dmp

Filesize
8KB

Download
memory/1032-47-0x0000000004BF0000-0x0000000004BF2000-memory.dmp

Filesize
8KB

Download
memory/1032-48-0x0000000004C00000-0x0000000004C02000-memory.dmp

Filesize
8KB

Download
memory/1032-49-0x0000000004CA0000-0x0000000004CA2000-memory.dmp

Filesize
8KB

Download
memory/1092-1-0x0000000000000000-mapping.dmp

Download
memory/1128-23-0x0000000000000000-mapping.dmp

Download
memory/1128-22-0x0000000000000000-mapping.dmp

Download
memory/1592-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads