Analysis
-
max time kernel
112s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 03:14
Static task
static1
Behavioral task
behavioral1
Sample
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe
Resource
win7-20220414-en
General
-
Target
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe
-
Size
2.0MB
-
MD5
12b7b9665e3a32bda9155e0f486359cd
-
SHA1
5acf1375160eacfd2a77db61f1a31705a8ba035c
-
SHA256
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f
-
SHA512
6ec801927336c96e0df56ab39e5834bb0c657a9798502c2b66e667587846c80b717925f716e760dc54ded0e4ee70da1cdf87c4daf145a40102c08dd1ec4d2e65
Malware Config
Signatures
-
KPOT Core Executable 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4072-131-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot behavioral2/memory/4072-132-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot behavioral2/memory/4072-134-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot behavioral2/memory/4072-135-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot behavioral2/memory/4072-136-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot behavioral2/memory/4072-137-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot behavioral2/memory/4072-140-0x0000000000060000-0x000000000093B000-memory.dmp family_kpot -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe -
Processes:
resource yara_rule behavioral2/memory/4072-130-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-131-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-132-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-134-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-135-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-136-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-137-0x0000000000060000-0x000000000093B000-memory.dmp themida behavioral2/memory/4072-140-0x0000000000060000-0x000000000093B000-memory.dmp themida -
Processes:
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exepid process 4072 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.execmd.exedescription pid process target process PID 4072 wrote to memory of 4924 4072 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe cmd.exe PID 4072 wrote to memory of 4924 4072 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe cmd.exe PID 4072 wrote to memory of 4924 4072 8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe cmd.exe PID 4924 wrote to memory of 4272 4924 cmd.exe PING.EXE PID 4924 wrote to memory of 4272 4924 cmd.exe PING.EXE PID 4924 wrote to memory of 4272 4924 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe"C:\Users\Admin\AppData\Local\Temp\8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4072-136-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-131-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-132-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-133-0x00000000770A0000-0x0000000077243000-memory.dmpFilesize
1.6MB
-
memory/4072-134-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-135-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-130-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-137-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-138-0x00000000770A0000-0x0000000077243000-memory.dmpFilesize
1.6MB
-
memory/4072-140-0x0000000000060000-0x000000000093B000-memory.dmpFilesize
8.9MB
-
memory/4072-141-0x00000000770A0000-0x0000000077243000-memory.dmpFilesize
1.6MB
-
memory/4272-142-0x0000000000000000-mapping.dmp
-
memory/4924-139-0x0000000000000000-mapping.dmp