Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-08-2021 00:14
Static task
static1
Behavioral task
behavioral1
Sample
1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe
-
Size
7.2MB
-
MD5
9cd27149543000c7f93e9943ecb9847e
-
SHA1
44ac42e9cfed91c80fb92600d522b674edbd3253
-
SHA256
1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574
-
SHA512
f17dfb4095d094bfd8cc01e639bbf518798b700ebf2959cc8fe224beeca7e458a758c22d11fe0c45daff8cbe3ce1dcabb67f2969179ad27af99b2cef6c4549ec
Score
10/10
Malware Config
Signatures
-
Klingon RAT Payload 3 IoCs
resource yara_rule behavioral1/files/0x00040000000130cc-64.dat family_klingon behavioral1/files/0x00040000000130cc-65.dat family_klingon behavioral1/files/0x00040000000130cc-67.dat family_klingon -
Executes dropped EXE 1 IoCs
pid Process 760 updater10.exe -
Loads dropped DLL 2 IoCs
pid Process 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "\"C:\\Users\\Admin\\AppData\\Local\\Windows Update\\updater10.exe\" -1 -0" 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org 7 api.ipify.org -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 updater10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e updater10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e updater10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e updater10.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1800 wmic.exe Token: SeSecurityPrivilege 1800 wmic.exe Token: SeTakeOwnershipPrivilege 1800 wmic.exe Token: SeLoadDriverPrivilege 1800 wmic.exe Token: SeSystemProfilePrivilege 1800 wmic.exe Token: SeSystemtimePrivilege 1800 wmic.exe Token: SeProfSingleProcessPrivilege 1800 wmic.exe Token: SeIncBasePriorityPrivilege 1800 wmic.exe Token: SeCreatePagefilePrivilege 1800 wmic.exe Token: SeBackupPrivilege 1800 wmic.exe Token: SeRestorePrivilege 1800 wmic.exe Token: SeShutdownPrivilege 1800 wmic.exe Token: SeDebugPrivilege 1800 wmic.exe Token: SeSystemEnvironmentPrivilege 1800 wmic.exe Token: SeRemoteShutdownPrivilege 1800 wmic.exe Token: SeUndockPrivilege 1800 wmic.exe Token: SeManageVolumePrivilege 1800 wmic.exe Token: 33 1800 wmic.exe Token: 34 1800 wmic.exe Token: 35 1800 wmic.exe Token: SeIncreaseQuotaPrivilege 1800 wmic.exe Token: SeSecurityPrivilege 1800 wmic.exe Token: SeTakeOwnershipPrivilege 1800 wmic.exe Token: SeLoadDriverPrivilege 1800 wmic.exe Token: SeSystemProfilePrivilege 1800 wmic.exe Token: SeSystemtimePrivilege 1800 wmic.exe Token: SeProfSingleProcessPrivilege 1800 wmic.exe Token: SeIncBasePriorityPrivilege 1800 wmic.exe Token: SeCreatePagefilePrivilege 1800 wmic.exe Token: SeBackupPrivilege 1800 wmic.exe Token: SeRestorePrivilege 1800 wmic.exe Token: SeShutdownPrivilege 1800 wmic.exe Token: SeDebugPrivilege 1800 wmic.exe Token: SeSystemEnvironmentPrivilege 1800 wmic.exe Token: SeRemoteShutdownPrivilege 1800 wmic.exe Token: SeUndockPrivilege 1800 wmic.exe Token: SeManageVolumePrivilege 1800 wmic.exe Token: 33 1800 wmic.exe Token: 34 1800 wmic.exe Token: 35 1800 wmic.exe Token: SeIncreaseQuotaPrivilege 112 wmic.exe Token: SeSecurityPrivilege 112 wmic.exe Token: SeTakeOwnershipPrivilege 112 wmic.exe Token: SeLoadDriverPrivilege 112 wmic.exe Token: SeSystemProfilePrivilege 112 wmic.exe Token: SeSystemtimePrivilege 112 wmic.exe Token: SeProfSingleProcessPrivilege 112 wmic.exe Token: SeIncBasePriorityPrivilege 112 wmic.exe Token: SeCreatePagefilePrivilege 112 wmic.exe Token: SeBackupPrivilege 112 wmic.exe Token: SeRestorePrivilege 112 wmic.exe Token: SeShutdownPrivilege 112 wmic.exe Token: SeDebugPrivilege 112 wmic.exe Token: SeSystemEnvironmentPrivilege 112 wmic.exe Token: SeRemoteShutdownPrivilege 112 wmic.exe Token: SeUndockPrivilege 112 wmic.exe Token: SeManageVolumePrivilege 112 wmic.exe Token: 33 112 wmic.exe Token: 34 112 wmic.exe Token: 35 112 wmic.exe Token: SeIncreaseQuotaPrivilege 112 wmic.exe Token: SeSecurityPrivilege 112 wmic.exe Token: SeTakeOwnershipPrivilege 112 wmic.exe Token: SeLoadDriverPrivilege 112 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 540 wrote to memory of 1800 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 28 PID 540 wrote to memory of 1800 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 28 PID 540 wrote to memory of 1800 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 28 PID 540 wrote to memory of 1360 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 30 PID 540 wrote to memory of 1360 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 30 PID 540 wrote to memory of 1360 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 30 PID 540 wrote to memory of 112 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 33 PID 540 wrote to memory of 112 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 33 PID 540 wrote to memory of 112 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 33 PID 540 wrote to memory of 672 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 34 PID 540 wrote to memory of 672 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 34 PID 540 wrote to memory of 672 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 34 PID 540 wrote to memory of 760 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 35 PID 540 wrote to memory of 760 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 35 PID 540 wrote to memory of 760 540 1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe 35 PID 760 wrote to memory of 1544 760 updater10.exe 36 PID 760 wrote to memory of 1544 760 updater10.exe 36 PID 760 wrote to memory of 1544 760 updater10.exe 36 PID 760 wrote to memory of 816 760 updater10.exe 37 PID 760 wrote to memory of 816 760 updater10.exe 37 PID 760 wrote to memory of 816 760 updater10.exe 37 PID 760 wrote to memory of 588 760 updater10.exe 38 PID 760 wrote to memory of 588 760 updater10.exe 38 PID 760 wrote to memory of 588 760 updater10.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe"C:\Users\Admin\AppData\Local\Temp\1be0fa9406c29a7abda87efbc7af4a6b1537d03cd5bdfc9f7c1e83d7deeaf574.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe ver2⤵PID:1360
-
-
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
-
-
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId2⤵PID:672
-
-
C:\Users\Admin\AppData\Local\Windows Update\updater10.exe"C:\Users\Admin\AppData\Local\Windows Update\updater10.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId3⤵PID:1544
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe ver3⤵PID:816
-
-
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId3⤵PID:588
-
-