Analysis
-
max time kernel
90s -
max time network
100s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
12-11-2021 04:08
Static task
static1
Behavioral task
behavioral1
Sample
44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe
-
Size
7.8MB
-
MD5
8d44ccac6b5512a416339984ad664d79
-
SHA1
6152e1a374fd572d25fab8baae9d1b12116a7c35
-
SHA256
44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611
-
SHA512
c83ad02780dde7bb40390fe496ad4b14289b5d270518734409604e50674dcae44e99acc01bdafaef5a504dd608f976a475af11eae28aa762acbaf84fa89312d7
Score
10/10
Malware Config
Signatures
-
Klingon RAT Payload 3 IoCs
resource yara_rule behavioral1/files/0x000600000001220e-58.dat family_klingon behavioral1/files/0x000600000001220e-59.dat family_klingon behavioral1/files/0x000600000001220e-61.dat family_klingon -
Executes dropped EXE 1 IoCs
pid Process 2040 updater10.exe -
Loads dropped DLL 2 IoCs
pid Process 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "\"C:\\Users\\Admin\\AppData\\Local\\Windows Update\\updater10.exe\" -1 -0" updater10.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 4 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1488 wmic.exe Token: SeSecurityPrivilege 1488 wmic.exe Token: SeTakeOwnershipPrivilege 1488 wmic.exe Token: SeLoadDriverPrivilege 1488 wmic.exe Token: SeSystemProfilePrivilege 1488 wmic.exe Token: SeSystemtimePrivilege 1488 wmic.exe Token: SeProfSingleProcessPrivilege 1488 wmic.exe Token: SeIncBasePriorityPrivilege 1488 wmic.exe Token: SeCreatePagefilePrivilege 1488 wmic.exe Token: SeBackupPrivilege 1488 wmic.exe Token: SeRestorePrivilege 1488 wmic.exe Token: SeShutdownPrivilege 1488 wmic.exe Token: SeDebugPrivilege 1488 wmic.exe Token: SeSystemEnvironmentPrivilege 1488 wmic.exe Token: SeRemoteShutdownPrivilege 1488 wmic.exe Token: SeUndockPrivilege 1488 wmic.exe Token: SeManageVolumePrivilege 1488 wmic.exe Token: 33 1488 wmic.exe Token: 34 1488 wmic.exe Token: 35 1488 wmic.exe Token: SeIncreaseQuotaPrivilege 1488 wmic.exe Token: SeSecurityPrivilege 1488 wmic.exe Token: SeTakeOwnershipPrivilege 1488 wmic.exe Token: SeLoadDriverPrivilege 1488 wmic.exe Token: SeSystemProfilePrivilege 1488 wmic.exe Token: SeSystemtimePrivilege 1488 wmic.exe Token: SeProfSingleProcessPrivilege 1488 wmic.exe Token: SeIncBasePriorityPrivilege 1488 wmic.exe Token: SeCreatePagefilePrivilege 1488 wmic.exe Token: SeBackupPrivilege 1488 wmic.exe Token: SeRestorePrivilege 1488 wmic.exe Token: SeShutdownPrivilege 1488 wmic.exe Token: SeDebugPrivilege 1488 wmic.exe Token: SeSystemEnvironmentPrivilege 1488 wmic.exe Token: SeRemoteShutdownPrivilege 1488 wmic.exe Token: SeUndockPrivilege 1488 wmic.exe Token: SeManageVolumePrivilege 1488 wmic.exe Token: 33 1488 wmic.exe Token: 34 1488 wmic.exe Token: 35 1488 wmic.exe Token: SeIncreaseQuotaPrivilege 600 wmic.exe Token: SeSecurityPrivilege 600 wmic.exe Token: SeTakeOwnershipPrivilege 600 wmic.exe Token: SeLoadDriverPrivilege 600 wmic.exe Token: SeSystemProfilePrivilege 600 wmic.exe Token: SeSystemtimePrivilege 600 wmic.exe Token: SeProfSingleProcessPrivilege 600 wmic.exe Token: SeIncBasePriorityPrivilege 600 wmic.exe Token: SeCreatePagefilePrivilege 600 wmic.exe Token: SeBackupPrivilege 600 wmic.exe Token: SeRestorePrivilege 600 wmic.exe Token: SeShutdownPrivilege 600 wmic.exe Token: SeDebugPrivilege 600 wmic.exe Token: SeSystemEnvironmentPrivilege 600 wmic.exe Token: SeRemoteShutdownPrivilege 600 wmic.exe Token: SeUndockPrivilege 600 wmic.exe Token: SeManageVolumePrivilege 600 wmic.exe Token: 33 600 wmic.exe Token: 34 600 wmic.exe Token: 35 600 wmic.exe Token: SeIncreaseQuotaPrivilege 600 wmic.exe Token: SeSecurityPrivilege 600 wmic.exe Token: SeTakeOwnershipPrivilege 600 wmic.exe Token: SeLoadDriverPrivilege 600 wmic.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 428 wrote to memory of 1488 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 29 PID 428 wrote to memory of 1488 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 29 PID 428 wrote to memory of 1488 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 29 PID 428 wrote to memory of 1188 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 31 PID 428 wrote to memory of 1188 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 31 PID 428 wrote to memory of 1188 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 31 PID 428 wrote to memory of 600 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 32 PID 428 wrote to memory of 600 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 32 PID 428 wrote to memory of 600 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 32 PID 428 wrote to memory of 2040 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 33 PID 428 wrote to memory of 2040 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 33 PID 428 wrote to memory of 2040 428 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe 33 PID 2040 wrote to memory of 1100 2040 updater10.exe 34 PID 2040 wrote to memory of 1100 2040 updater10.exe 34 PID 2040 wrote to memory of 1100 2040 updater10.exe 34 PID 2040 wrote to memory of 1004 2040 updater10.exe 35 PID 2040 wrote to memory of 1004 2040 updater10.exe 35 PID 2040 wrote to memory of 1004 2040 updater10.exe 35 PID 2040 wrote to memory of 1620 2040 updater10.exe 36 PID 2040 wrote to memory of 1620 2040 updater10.exe 36 PID 2040 wrote to memory of 1620 2040 updater10.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe"C:\Users\Admin\AppData\Local\Temp\44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe ver2⤵PID:1188
-
-
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:600
-
-
C:\Users\Admin\AppData\Local\Windows Update\updater10.exe"C:\Users\Admin\AppData\Local\Windows Update\updater10.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId3⤵PID:1100
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe ver3⤵PID:1004
-
-
C:\Windows\System32\Wbem\wmic.exewmic process get Caption,ParentProcessId,ProcessId3⤵PID:1620
-
-