75352a45b67b3a7f91e237cc5dc2de79f52e0e13b81fe10e289199477f2d46c9

Analysis

max time kernel
151s
max time network
56s
platform
windows7_x64
resource
win7v200430
submitted
19/07/2020, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kins_1.0.0.2.vir.exe
Size 308KB
Sample200719-52w648tx22
SHA256 75352a45b67b3a7f91e237cc5dc2de79f52e0e13b81fe10e289199477f2d46c9
MD5 fcfe12b0e6d1ff5692e6f8f40f888b26
SHA1 176e99634eb509404b4e1d0b8fa2f031ceb7fdaf
SHA512 41e8392282c3e7e21a1edaa0eb7f0b04459043f2181f406bf51a14f594ab92b46cb20f0220b4f8f3041132caf60351474500c904344a962ddf67f98ac2df190a
MD5 SHA1 SHA512

Score

8^/10

evasion trojan persistence

Malware Config

Signatures

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\3BF147E2-00000001.eml:OECustomProperty	WinMail.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1416	kins_1.0.0.2.vir.exe
Token: SeManageVolumePrivilege	1032	WinMail.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	24
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	24
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	24
PID 1416 wrote to memory of 1092	1416	kins_1.0.0.2.vir.exe	24
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1092 wrote to memory of 1592	1092	ipat.exe	25
PID 1592 wrote to memory of 1072	1592	explorer.exe	18
PID 1592 wrote to memory of 1072	1592	explorer.exe	18
PID 1592 wrote to memory of 1072	1592	explorer.exe	18
PID 1592 wrote to memory of 1072	1592	explorer.exe	18
PID 1592 wrote to memory of 1072	1592	explorer.exe	18
PID 1592 wrote to memory of 1160	1592	explorer.exe	19
PID 1592 wrote to memory of 1160	1592	explorer.exe	19
PID 1592 wrote to memory of 1160	1592	explorer.exe	19
PID 1592 wrote to memory of 1160	1592	explorer.exe	19
PID 1592 wrote to memory of 1160	1592	explorer.exe	19
PID 1592 wrote to memory of 1212	1592	explorer.exe	20
PID 1592 wrote to memory of 1212	1592	explorer.exe	20
PID 1592 wrote to memory of 1212	1592	explorer.exe	20
PID 1592 wrote to memory of 1212	1592	explorer.exe	20
PID 1592 wrote to memory of 1212	1592	explorer.exe	20
PID 1592 wrote to memory of 1416	1592	explorer.exe	23
PID 1592 wrote to memory of 1416	1592	explorer.exe	23
PID 1592 wrote to memory of 1416	1592	explorer.exe	23
PID 1592 wrote to memory of 1416	1592	explorer.exe	23
PID 1592 wrote to memory of 1416	1592	explorer.exe	23
PID 1092 wrote to memory of 1032	1092	ipat.exe	26
PID 1092 wrote to memory of 1032	1092	ipat.exe	26
PID 1092 wrote to memory of 1032	1092	ipat.exe	26
PID 1092 wrote to memory of 1032	1092	ipat.exe	26
PID 1092 wrote to memory of 1032	1092	ipat.exe	26
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	27
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	27
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	27
PID 1416 wrote to memory of 1128	1416	kins_1.0.0.2.vir.exe	27
PID 1592 wrote to memory of 1128	1592	explorer.exe	27
PID 1592 wrote to memory of 1128	1592	explorer.exe	27
PID 1592 wrote to memory of 1128	1592	explorer.exe	27
PID 1592 wrote to memory of 1128	1592	explorer.exe	27
PID 1592 wrote to memory of 1128	1592	explorer.exe	27

Executes dropped EXE 1 IoCs

pid	Process
1092	ipat.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1592	explorer.exe
1092	ipat.exe
1092	ipat.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe
1592	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	WinMail.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

Loads dropped DLL 1 IoCs

pid	Process
1416	kins_1.0.0.2.vir.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1032	WinMail.exe

Deletes itself 1 IoCs

pid	Process
1128	cmd.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1032	WinMail.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\ipat.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Ceavx\\ipat.exe"	explorer.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1072

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.2.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\kins_1.0.0.2.vir.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - Loads dropped DLL
  PID:1416
- - C:\Users\Admin\AppData\Roaming\Ceavx\ipat.exe
    "C:\Users\Admin\AppData\Roaming\Ceavx\ipat.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious behavior: EnumeratesProcesses
      Checks whether UAC is enabled
      Adds Run key to start application
      PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcceb785b.bat"
    3⤵
    - Deletes itself
    PID:1128

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-29-0x00000000041C0000-0x00000000041C2000-memory.dmp

Download

memory/1032-43-0x0000000004B90000-0x0000000004B92000-memory.dmp

Download

memory/1032-7-0x0000000003910000-0x0000000003B10000-memory.dmp

Download

memory/1032-9-0x0000000003910000-0x0000000003A10000-memory.dmp

Download

memory/1032-10-0x0000000003910000-0x0000000003B10000-memory.dmp

Download

memory/1032-11-0x0000000003A10000-0x0000000003B10000-memory.dmp

Download

memory/1032-15-0x0000000002660000-0x0000000002662000-memory.dmp

Download

memory/1032-16-0x0000000002650000-0x0000000002652000-memory.dmp

Download

memory/1032-17-0x0000000002670000-0x0000000002672000-memory.dmp

Download

memory/1032-18-0x0000000002660000-0x0000000002662000-memory.dmp

Download

memory/1032-19-0x0000000003D70000-0x0000000003D72000-memory.dmp

Download

memory/1032-20-0x0000000002660000-0x0000000002662000-memory.dmp

Download

memory/1032-21-0x0000000003C50000-0x0000000003C52000-memory.dmp

Download

memory/1032-33-0x00000000043C0000-0x00000000043C2000-memory.dmp

Download

memory/1032-59-0x00000000020D0000-0x00000000020E0000-memory.dmp

Download

memory/1032-32-0x0000000004400000-0x0000000004402000-memory.dmp

Download

memory/1032-25-0x0000000002660000-0x0000000002662000-memory.dmp

Download

memory/1032-26-0x0000000003F10000-0x0000000003F12000-memory.dmp

Download

memory/1032-27-0x0000000004170000-0x0000000004172000-memory.dmp

Download

memory/1032-28-0x00000000042D0000-0x00000000042D2000-memory.dmp

Download

memory/1032-53-0x0000000002130000-0x0000000002140000-memory.dmp

Download

memory/1032-30-0x00000000042E0000-0x00000000042E2000-memory.dmp

Download

memory/1032-5-0x0000000003910000-0x0000000003A10000-memory.dmp

Download

memory/1032-51-0x0000000003910000-0x0000000003A10000-memory.dmp

Download

memory/1032-50-0x0000000004C90000-0x0000000004C92000-memory.dmp

Download

memory/1032-34-0x0000000004410000-0x0000000004412000-memory.dmp

Download

memory/1032-35-0x00000000043B0000-0x00000000043B2000-memory.dmp

Download

memory/1032-36-0x0000000004690000-0x0000000004692000-memory.dmp

Download

memory/1032-37-0x00000000043A0000-0x00000000043A2000-memory.dmp

Download

memory/1032-38-0x00000000046A0000-0x00000000046A2000-memory.dmp

Download

memory/1032-39-0x0000000004390000-0x0000000004392000-memory.dmp

Download

memory/1032-40-0x0000000004B70000-0x0000000004B72000-memory.dmp

Download

memory/1032-41-0x0000000004380000-0x0000000004382000-memory.dmp

Download

memory/1032-42-0x0000000004B80000-0x0000000004B82000-memory.dmp

Download

memory/1032-31-0x00000000042F0000-0x00000000042F2000-memory.dmp

Download

memory/1032-44-0x0000000003B80000-0x0000000003B82000-memory.dmp

Download

memory/1032-45-0x0000000004BA0000-0x0000000004BA2000-memory.dmp

Download

memory/1032-46-0x0000000003B40000-0x0000000003B42000-memory.dmp

Download

memory/1032-47-0x0000000004BF0000-0x0000000004BF2000-memory.dmp

Download

memory/1032-48-0x0000000004C00000-0x0000000004C02000-memory.dmp

Download

memory/1032-49-0x0000000004CA0000-0x0000000004CA2000-memory.dmp

Download