91cd8bfbe714acc43beff32856c3d56ded48706d3c92c492a1acb994b606003b

Analysis

max time kernel
1551s
max time network
1745s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16-02-2022 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

all/gcs/Koid.exe
Size

1.5MB
MD5

15ec276e3c1d3d757eed8698c59c1095
SHA1

28be0d3db48ef6423c2c4e222f5f949b8ed6e845
SHA256

4bf92841621b08ec1796fa380fd71bd9f6fec65b923aec1dbd5b074f062eaf21
SHA512

467196ee35523d4a24bd3746a9785040e092e4aba096c4e342ce1dfe2a9c3b1ca61f207b4581ac97a3861f12f714581854339727681aba1ba93d8e36ef9eb671

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	4484	svchost.exe
Token: SeCreatePagefilePrivilege	4484	svchost.exe
Token: SeShutdownPrivilege	4484	svchost.exe
Token: SeCreatePagefilePrivilege	4484	svchost.exe
Token: SeShutdownPrivilege	4484	svchost.exe
Token: SeCreatePagefilePrivilege	4484	svchost.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe
Token: SeRestorePrivilege	788	TiWorker.exe
Token: SeSecurityPrivilege	788	TiWorker.exe
Token: SeBackupPrivilege	788	TiWorker.exe

C:\Users\Admin\AppData\Local\Temp\all\gcs\Koid.exe
"C:\Users\Admin\AppData\Local\Temp\all\gcs\Koid.exe"
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4484-130-0x000001611DD80000-0x000001611DD90000-memory.dmp

Filesize
64KB

Download
memory/4484-131-0x000001611E420000-0x000001611E430000-memory.dmp

Filesize
64KB

Download
memory/4484-132-0x0000016120B00000-0x0000016120B04000-memory.dmp

Filesize
16KB

Download
memory/4484-133-0x0000016120B20000-0x0000016120B24000-memory.dmp

Filesize
16KB

Download
memory/4484-134-0x0000016120A60000-0x0000016120A61000-memory.dmp

Filesize
4KB

Download
memory/4484-136-0x0000016120A20000-0x0000016120A21000-memory.dmp

Filesize
4KB

Download