20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06

Analysis

max time kernel
155s
max time network
72s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
Size

2.0MB
MD5

1047310d2de8ca872b60a26f25d93d3a
SHA1

f2a195007976f6dc9bb9d5d6fc1470269c5a7e47
SHA256

20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06
SHA512

43c8255b2305e54c6437f127ad869dc4d7eb5dfa5b92615919ac1156337ca5c1e2d97234af471527db7d3e7567b27d6051664d767b4965715f89e865ec06a8d1
SSDEEP

49152:Rc//////NIc0OFN8kH3i+Yo72DvJQ65MAGH3CU9WxtK9:Rc//////NI3OFnitLDRb5N4f

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
952	KAntiH.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1348-1975-0x0000000000260000-0x000000000029E000-memory.dmp	upx
behavioral1/memory/1348-4292-0x0000000000260000-0x000000000029E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\inf\KAntiH.exe	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	KAntiH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	KAntiH.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe
952	KAntiH.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
952	KAntiH.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27
PID 1640 wrote to memory of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27
PID 1640 wrote to memory of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27
PID 1640 wrote to memory of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27
PID 1640 wrote to memory of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27
PID 1640 wrote to memory of 1348	1640	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	27
PID 1348 wrote to memory of 952	1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	28
PID 1348 wrote to memory of 952	1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	28
PID 1348 wrote to memory of 952	1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	28
PID 1348 wrote to memory of 952	1348	20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe	28

C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
"C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
  C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\inf\KAntiH.exe
    C:\Windows\inf\KAntiH.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\inf\KAntiH.exe

Filesize
988KB

MD5
68c95b5bf71f2b84a5a30458ee23b9cd

SHA1
cc3233cc88f4f3a11a417861b142f77aa4f8ba54

SHA256
4a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8

SHA512
23809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd

Download Submit
C:\Windows\inf\KAntiH.exe

Filesize
988KB

MD5
68c95b5bf71f2b84a5a30458ee23b9cd

SHA1
cc3233cc88f4f3a11a417861b142f77aa4f8ba54

SHA256
4a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8

SHA512
23809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd

Download Submit
\Windows\inf\KAntiH.exe

Filesize
988KB

MD5
68c95b5bf71f2b84a5a30458ee23b9cd

SHA1
cc3233cc88f4f3a11a417861b142f77aa4f8ba54

SHA256
4a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8

SHA512
23809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd

Download Submit
\Windows\inf\KAntiH.exe

Filesize
988KB

MD5
68c95b5bf71f2b84a5a30458ee23b9cd

SHA1
cc3233cc88f4f3a11a417861b142f77aa4f8ba54

SHA256
4a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8

SHA512
23809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd

Download Submit
memory/952-517-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-1346-0x0000000002640000-0x00000000027C1000-memory.dmp

Filesize
1.5MB

Download
memory/952-5150-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download
memory/952-5148-0x0000000002480000-0x0000000002580000-memory.dmp

Filesize
1024KB

Download
memory/952-67-0x0000000076100000-0x0000000076147000-memory.dmp

Filesize
284KB

Download
memory/952-473-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-474-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-475-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-476-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-477-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-515-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-478-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-480-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-5147-0x0000000002BA0000-0x0000000002C41000-memory.dmp

Filesize
644KB

Download
memory/952-5146-0x0000000002A90000-0x0000000002B91000-memory.dmp

Filesize
1.0MB

Download
memory/952-482-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-487-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download
memory/952-486-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-4080-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-484-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-532-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-531-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-530-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-529-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-528-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-527-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-526-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-525-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-524-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-523-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-522-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-521-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-513-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-519-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-518-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-4082-0x0000000002480000-0x0000000002580000-memory.dmp

Filesize
1024KB

Download
memory/952-516-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-479-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-514-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-520-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-512-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-511-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-510-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-509-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-508-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-507-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-506-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-505-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-504-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-503-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-502-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-501-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-500-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-499-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-498-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-497-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-496-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-495-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-494-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-493-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-492-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-491-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-490-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-489-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-488-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/952-1345-0x0000000002970000-0x0000000002A81000-memory.dmp

Filesize
1.1MB

Download
memory/1348-60-0x0000000000400000-0x000000000074C000-memory.dmp

Filesize
3.3MB

Download
memory/1348-1975-0x0000000000260000-0x000000000029E000-memory.dmp

Filesize
248KB

Download
memory/1348-3105-0x0000000000400000-0x000000000074C000-memory.dmp

Filesize
3.3MB

Download
memory/1348-54-0x0000000000400000-0x000000000074C000-memory.dmp

Filesize
3.3MB

Download
memory/1348-485-0x00000000026E0000-0x00000000027D7000-memory.dmp

Filesize
988KB

Download
memory/1348-4292-0x0000000000260000-0x000000000029E000-memory.dmp

Filesize
248KB

Download
memory/1348-483-0x00000000026E0000-0x00000000027D7000-memory.dmp

Filesize
988KB

Download
memory/1348-481-0x0000000000400000-0x000000000074C000-memory.dmp

Filesize
3.3MB

Download
memory/1348-56-0x0000000000400000-0x000000000074C000-memory.dmp

Filesize
3.3MB

Download
memory/1348-5149-0x00000000026E0000-0x00000000027D7000-memory.dmp

Filesize
988KB

Download
memory/1348-59-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download