Overview

overview

10

Static

static

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

8

Resubmissions

03/07/2024, 16:04 UTC

240703-thygmaycpc 10

01/07/2024, 18:12 UTC

240701-ws6xvswbkj 10

01/07/2024, 18:03 UTC

240701-wm5sls1gka 10

01/07/2024, 18:03 UTC

240701-wm39sa1gjf 10

01/07/2024, 18:03 UTC

240701-wm2e7avhkj 10

01/07/2024, 18:03 UTC

240701-wmzxcs1fre 10

01/07/2024, 18:02 UTC

240701-wmzats1frc 10

01/07/2024, 18:02 UTC

240701-wmvbwa1fqh 10

22/11/2023, 17:02 UTC

231122-vkac9adg64 10

Analysis

  • max time kernel
    1467s
  • max time network
    1470s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19/11/2020, 13:14 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    KLwC6vii.exe

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KLwC6vii.exe
    "C:\Users\Admin\AppData\Local\Temp\KLwC6vii.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:984

Network

  • flag-unknown
    DNS
    shnf-47787.portmap.io
    Remote address:
    8.8.8.8:53
    Request
    shnf-47787.portmap.io
    IN A
    Response
    shnf-47787.portmap.io
    IN A
    193.161.193.99
  • flag-unknown
    DNS
    shnf-47787.portmap.io
    Remote address:
    8.8.8.8:53
    Request
    shnf-47787.portmap.io
    IN A
    Response
    shnf-47787.portmap.io
    IN A
    193.161.193.99
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     80 B
     3
    2
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    156 B
     120 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    936 B
     172 B
     6
    4
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    563 B
     172 B
     5
    4
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    563 B
     172 B
     5
    4
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    563 B
     172 B
     5
    4
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    563 B
     172 B
     5
    4
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    563 B
     172 B
     5
    4
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    471 B
     132 B
     3
    3
  • 193.161.193.99:47787
    shnf-47787.portmap.io
    KLwC6vii.exe
    6.1kB
     5.1kB
     96
    108
  • 8.8.8.8:53
    shnf-47787.portmap.io
    dns
    67 B
     83 B
     1
    1

    DNS Request

    shnf-47787.portmap.io

    DNS Response

    193.161.193.99

  • 8.8.8.8:53
    shnf-47787.portmap.io
    dns
    67 B
     83 B
     1
    1

    DNS Request

    shnf-47787.portmap.io

    DNS Response

    193.161.193.99

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/984-0-0x00007FF820810000-0x00007FF8211B0000-memory.dmp

    Filesize

    9.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.