50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
18-07-2022 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
Size

1.0MB
MD5

31d5f481153ccd2829558720f8d90d81
SHA1

386e3ed949e9be17b0b715e8b1f54aea134f1172
SHA256

50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158
SHA512

4a1f8a84dbf3c15fdd2290be7c285a8ee774b42171268a5d646eee3dc0524bcd846c82dd30061c5ea022c033b3312ef0871c36d2c3b2acf8bf94f5eccd5cec9d

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

kele.exe

pid process

1468 kele.exe
Loads dropped DLL 1 IoCs

Processes:

50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe

pid process

1064 50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1468	kele.exe

Drops file in Program Files directory 5 IoCs

Processes:

50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exekele.exe

description	ioc	process
File opened for modification	C:\Program Files\kele55\Install\kele.exe.ggb	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
File created	C:\Program Files\kele55\Install\kele.exe.ggb	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
File opened for modification	C:\Program Files\kele55\Install\kele.exe.ggd	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
File opened for modification	C:\Program Files\kele55\Install\kele.exe	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
File opened for modification	C:\Program Files\kele55\Install\log\20220718 215512.log	kele.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exekele.exe

pid	process
1064	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
1064	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
1468	kele.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe

description	pid	process	target process
PID 1064 wrote to memory of 1468	1064	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe	kele.exe
PID 1064 wrote to memory of 1468	1064	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe	kele.exe
PID 1064 wrote to memory of 1468	1064	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe	kele.exe
PID 1064 wrote to memory of 1468	1064	50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe	kele.exe

C:\Users\Admin\AppData\Local\Temp\50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe
"C:\Users\Admin\AppData\Local\Temp\50c386d8ad900208670041d0591eae303aa80f158c1b4c74fe01987594f16158.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files\kele55\Install\kele.exe
  "C:\Program Files\kele55\Install\kele.exe" /S /AUTOSTART=FALSE /COMMENDER_ID=cmVjX2lkOjAscmVjX3R5cGU6MCxyZWNfYWQ6MCxzcmNfdXJsOix3ZWJfaWQ6LA== /D=C:\Program Files\kele55
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\kele55\Install\kele.exe

Filesize
1.3MB

MD5
bde29dee841faf6a084a57bcc7bf4513

SHA1
e730310f63f16c2737a4d3c9706d93c36941bfd1

SHA256
9a2cc0153a1a5633baead2e7e1e9360fbe2c647faaf59c1d1eafa45141d829f1

SHA512
8b94495e6426beffca765edde233ec8fb683e5a2113814073e388a78801e0f716c8991401d2b81c9b6536753545127c44ab9681bdac3847c83c3a0a41980fa5b

Download Submit
\Program Files\kele55\Install\kele.exe

Filesize
1.3MB

MD5
bde29dee841faf6a084a57bcc7bf4513

SHA1
e730310f63f16c2737a4d3c9706d93c36941bfd1

SHA256
9a2cc0153a1a5633baead2e7e1e9360fbe2c647faaf59c1d1eafa45141d829f1

SHA512
8b94495e6426beffca765edde233ec8fb683e5a2113814073e388a78801e0f716c8991401d2b81c9b6536753545127c44ab9681bdac3847c83c3a0a41980fa5b

Download Submit
memory/1064-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1468-56-0x0000000000000000-mapping.dmp

Download