Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe
Resource
win7-20220414-en
General
-
Target
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe
-
Size
406KB
-
MD5
7a53429710e5d456bd79c147316c1bbb
-
SHA1
4d46fc427c0c5aa412e13b96dd6be72044ceb18d
-
SHA256
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135
-
SHA512
2673325f08ff43f0a6afcdac341f7fe944927153c09efb14e16dd53974cabba283ca41c03a5c40bc5e0d5d5537d7757284ef7dce70383881deb6c0d2efaa769a
Malware Config
Signatures
-
KPOT Core Executable 3 IoCs
Processes:
resource yara_rule behavioral2/memory/904-137-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot behavioral2/memory/904-138-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot behavioral2/memory/904-140-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exedescription pid process target process PID 796 set thread context of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exepid process 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exedescription pid process Token: SeDebugPrivilege 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.execmd.exedescription pid process target process PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 796 wrote to memory of 904 796 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 904 wrote to memory of 4556 904 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 904 wrote to memory of 4556 904 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 904 wrote to memory of 4556 904 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 4556 wrote to memory of 372 4556 cmd.exe PING.EXE PID 4556 wrote to memory of 372 4556 cmd.exe PING.EXE PID 4556 wrote to memory of 372 4556 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-141-0x0000000000000000-mapping.dmp
-
memory/796-130-0x0000000000E20000-0x0000000000E8C000-memory.dmpFilesize
432KB
-
memory/796-131-0x00000000061A0000-0x0000000006744000-memory.dmpFilesize
5.6MB
-
memory/796-132-0x0000000005C90000-0x0000000005D22000-memory.dmpFilesize
584KB
-
memory/796-133-0x0000000005C20000-0x0000000005C2A000-memory.dmpFilesize
40KB
-
memory/796-134-0x00000000087B0000-0x00000000087C2000-memory.dmpFilesize
72KB
-
memory/796-135-0x0000000008A00000-0x0000000008A9C000-memory.dmpFilesize
624KB
-
memory/904-136-0x0000000000000000-mapping.dmp
-
memory/904-137-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/904-138-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/904-140-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4556-139-0x0000000000000000-mapping.dmp