Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2022 06:26
Static task
static1
Behavioral task
behavioral1
Sample
KOPIA_PL.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
KOPIA_PL.exe
Resource
win10-20220812-en
General
-
Target
KOPIA_PL.exe
-
Size
279KB
-
MD5
957f050d064565a4c7d9ca1ff9025c3e
-
SHA1
5687d9cc3e3fc1ef65c5efa39b2b795bd48604e5
-
SHA256
bdaf2cc27694475beaef6b0945e952e41e3ab6972bae7243b3656c6a87d2bb0e
-
SHA512
a5da71119fa05c69f8c8ec1632944c891a2360d07de95645370eeca67e565de25a49c11a1d50c33a700de5d6e38e6c0d56811613350e92914ec8394e2ae46abd
-
SSDEEP
6144:h18i/ZxjC1bf3jTb6BYmQ6WCjEQoF2jjTF6wJPjxG:h18OZxWTvb6i+WCjEQi2jjDo
Malware Config
Extracted
formbook
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Extracted
xloader
3.8
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
KOPIA_PL.execvtres.exesvchost.exedescription pid process target process PID 4200 set thread context of 360 4200 KOPIA_PL.exe cvtres.exe PID 360 set thread context of 2288 360 cvtres.exe Explorer.EXE PID 360 set thread context of 2288 360 cvtres.exe Explorer.EXE PID 4224 set thread context of 2288 4224 svchost.exe Explorer.EXE -
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-3844063266-715245855-4050956231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
cvtres.exesvchost.exepid process 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
cvtres.exesvchost.exepid process 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 360 cvtres.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe 4224 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.exesvchost.exedescription pid process Token: SeDebugPrivilege 360 cvtres.exe Token: SeDebugPrivilege 4224 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
KOPIA_PL.exeExplorer.EXEsvchost.exedescription pid process target process PID 4200 wrote to memory of 360 4200 KOPIA_PL.exe cvtres.exe PID 4200 wrote to memory of 360 4200 KOPIA_PL.exe cvtres.exe PID 4200 wrote to memory of 360 4200 KOPIA_PL.exe cvtres.exe PID 4200 wrote to memory of 360 4200 KOPIA_PL.exe cvtres.exe PID 4200 wrote to memory of 360 4200 KOPIA_PL.exe cvtres.exe PID 4200 wrote to memory of 360 4200 KOPIA_PL.exe cvtres.exe PID 2288 wrote to memory of 4224 2288 Explorer.EXE svchost.exe PID 2288 wrote to memory of 4224 2288 Explorer.EXE svchost.exe PID 2288 wrote to memory of 4224 2288 Explorer.EXE svchost.exe PID 4224 wrote to memory of 5044 4224 svchost.exe Firefox.exe PID 4224 wrote to memory of 5044 4224 svchost.exe Firefox.exe PID 4224 wrote to memory of 5044 4224 svchost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KOPIA_PL.exe"C:\Users\Admin\AppData\Local\Temp\KOPIA_PL.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-180-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-194-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/360-162-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-196-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-172-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-163-0x00000000004012B0-mapping.dmp
-
memory/360-192-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/360-188-0x0000000004E90000-0x00000000051B0000-memory.dmpFilesize
3.1MB
-
memory/360-189-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/360-164-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-181-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-177-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-184-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-183-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-166-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-168-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-182-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-178-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-173-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-176-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-175-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-174-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/360-171-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/360-170-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-167-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2288-260-0x00000000061B0000-0x000000000632E000-memory.dmpFilesize
1.5MB
-
memory/2288-221-0x00000000061B0000-0x000000000632E000-memory.dmpFilesize
1.5MB
-
memory/2288-190-0x0000000005CB0000-0x0000000005E3F000-memory.dmpFilesize
1.6MB
-
memory/2288-193-0x00000000024C0000-0x00000000025C5000-memory.dmpFilesize
1.0MB
-
memory/4200-136-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-115-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-146-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-147-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-148-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-149-0x00000000000C0000-0x000000000010A000-memory.dmpFilesize
296KB
-
memory/4200-150-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-151-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-152-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-153-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-154-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-155-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-156-0x00000000022E0000-0x00000000022EC000-memory.dmpFilesize
48KB
-
memory/4200-157-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-158-0x00000000022F0000-0x00000000022F8000-memory.dmpFilesize
32KB
-
memory/4200-159-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-160-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-161-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-144-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-143-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-142-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-165-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-141-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-140-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-139-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-138-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-137-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-145-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-135-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-134-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-133-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-132-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-131-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-130-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-129-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-128-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-127-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-126-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-125-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-124-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-123-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-122-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-121-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-120-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-119-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-116-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-118-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4200-117-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4224-211-0x0000000003620000-0x0000000003940000-memory.dmpFilesize
3.1MB
-
memory/4224-210-0x0000000000990000-0x00000000009BD000-memory.dmpFilesize
180KB
-
memory/4224-216-0x0000000003300000-0x000000000348D000-memory.dmpFilesize
1.6MB
-
memory/4224-209-0x0000000000EC0000-0x0000000000ECC000-memory.dmpFilesize
48KB
-
memory/4224-222-0x0000000000990000-0x00000000009BD000-memory.dmpFilesize
180KB
-
memory/4224-223-0x0000000003300000-0x000000000348D000-memory.dmpFilesize
1.6MB
-
memory/4224-195-0x0000000000000000-mapping.dmp