Overview
overview
10Static
static
8all/clicke...fy.exe
windows7_x64
7all/clicke...fy.exe
windows10-2004_x64
7all/clicke...v2.exe
windows7_x64
8all/clicke...v2.exe
windows10-2004_x64
8all/clicke...on.exe
windows7_x64
1all/clicke...on.exe
windows10-2004_x64
4all/clicke...er.exe
windows7_x64
1all/clicke...er.exe
windows10-2004_x64
7all/clicke...p3.exe
windows7_x64
8all/clicke...p3.exe
windows10-2004_x64
8all/clicke...ao.exe
windows7_x64
4all/clicke...ao.exe
windows10-2004_x64
6all/clickers/vega.exe
windows7_x64
1all/clickers/vega.exe
windows10-2004_x64
10all/gcs/Cl...er.exe
windows7_x64
7all/gcs/Cl...er.exe
windows10-2004_x64
7all/gcs/Icetea.exe
windows7_x64
1all/gcs/Icetea.exe
windows10-2004_x64
4all/gcs/Koid.exe
windows7_x64
1all/gcs/Koid.exe
windows10-2004_x64
4all/gcs/crypt.exe
windows7_x64
9all/gcs/crypt.exe
windows10-2004_x64
9all/gcs/en...an.exe
windows7_x64
8all/gcs/en...an.exe
windows10-2004_x64
8all/gcs/epic.exe
windows7_x64
1all/gcs/epic.exe
windows10-2004_x64
4all/gcs/itami.exe
windows7_x64
1all/gcs/itami.exe
windows10-2004_x64
4all/gcs/kr...nt.exe
windows7_x64
1all/gcs/kr...nt.exe
windows10-2004_x64
9all/gcs/kura.exe
windows7_x64
1all/gcs/kura.exe
windows10-2004_x64
9Analysis
-
max time kernel
1547s -
max time network
1738s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 17:24
Behavioral task
behavioral1
Sample
all/clickers/Spotify.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
all/clickers/Spotify.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
all/clickers/axentav2.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
all/clickers/axentav2.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
all/clickers/isolation.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
all/clickers/isolation.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
all/clickers/mangoclicker.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
all/clickers/mangoclicker.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
all/clickers/nigclickermp3.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
all/clickers/nigclickermp3.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
all/clickers/slinkylmao.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
all/clickers/slinkylmao.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral13
Sample
all/clickers/vega.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
all/clickers/vega.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral15
Sample
all/gcs/Client_Loader.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
all/gcs/Client_Loader.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
all/gcs/Icetea.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
all/gcs/Icetea.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
all/gcs/Koid.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
all/gcs/Koid.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral21
Sample
all/gcs/crypt.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
all/gcs/crypt.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral23
Sample
all/gcs/encephalon_clean.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
all/gcs/encephalon_clean.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral25
Sample
all/gcs/epic.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
all/gcs/epic.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral27
Sample
all/gcs/itami.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
all/gcs/itami.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
all/gcs/kryptonclient.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
all/gcs/kryptonclient.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral31
Sample
all/gcs/kura.exe
Resource
win7-en-20211208
General
-
Target
all/gcs/kura.exe
-
Size
3.3MB
-
MD5
208a92b2100ef3dc268b709e7a9aa3e2
-
SHA1
2825a5777445dd584289fe35e41c836f8743dbcb
-
SHA256
5e8394b44ba1373b36214d09b16a43ada6d001e55509de72c1f85928481422b0
-
SHA512
fa64f5ab44d63ee3963dfbc4c49f089fb9395c55a4847096c7791935876bfdb91af6653dc27db6a012cfba02ef97b7e5ac278a5145f1ad3b80fa735f1d86699a
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
kura.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion kura.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion kura.exe -
Processes:
resource yara_rule behavioral32/memory/3528-131-0x00007FF78D6B0000-0x00007FF78DFB4000-memory.dmp themida behavioral32/memory/3528-132-0x00007FF78D6B0000-0x00007FF78DFB4000-memory.dmp themida -
Processes:
kura.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kura.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
kura.exepid process 3528 kura.exe -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exeTiWorker.exedescription pid process Token: SeShutdownPrivilege 2776 svchost.exe Token: SeCreatePagefilePrivilege 2776 svchost.exe Token: SeShutdownPrivilege 2776 svchost.exe Token: SeCreatePagefilePrivilege 2776 svchost.exe Token: SeShutdownPrivilege 2776 svchost.exe Token: SeCreatePagefilePrivilege 2776 svchost.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe Token: SeRestorePrivilege 3856 TiWorker.exe Token: SeSecurityPrivilege 3856 TiWorker.exe Token: SeBackupPrivilege 3856 TiWorker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
kura.exedescription pid process target process PID 3528 wrote to memory of 3704 3528 kura.exe cmd.exe PID 3528 wrote to memory of 3704 3528 kura.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\all\gcs\kura.exe"C:\Users\Admin\AppData\Local\Temp\all\gcs\kura.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2776-133-0x000001D13D530000-0x000001D13D540000-memory.dmpFilesize
64KB
-
memory/2776-134-0x000001D13D5A0000-0x000001D13D5B0000-memory.dmpFilesize
64KB
-
memory/2776-135-0x000001D1402B0000-0x000001D1402B4000-memory.dmpFilesize
16KB
-
memory/2776-136-0x000001D1402D0000-0x000001D1402D4000-memory.dmpFilesize
16KB
-
memory/2776-137-0x000001D140210000-0x000001D140211000-memory.dmpFilesize
4KB
-
memory/2776-139-0x000001D1401D0000-0x000001D1401D1000-memory.dmpFilesize
4KB
-
memory/3528-130-0x00007FFF998F0000-0x00007FFF998F2000-memory.dmpFilesize
8KB
-
memory/3528-131-0x00007FF78D6B0000-0x00007FF78DFB4000-memory.dmpFilesize
9.0MB
-
memory/3528-132-0x00007FF78D6B0000-0x00007FF78DFB4000-memory.dmpFilesize
9.0MB