bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794

Analysis

max time kernel
152s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe
Size

559KB
MD5

90ebcc3bbd9cd91908b8d4a826c2f374
SHA1

371f0f5e366d8777f643d867af95503692fa5f2f
SHA256

bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794
SHA512

3d09427fa4f48a62bdf37125e7a8fde9eda9f9106f01e1eed82e33589cd417a480bb8a1d8e7afb47d9b20552d9a17d43d9f56550aa011f2591bb04c68bc1e8fd
SSDEEP

12288:R9yMyjbUt2FhWWogPs+cmtYeiDZqYJwAkkYxZDBBPjYRVviCPv:KMb2F/E+cvSkaNBPjYRVaCPv

Score

8^/10

adware aspackv2 persistence stealer

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000022e50-141.dat	aspack_v212_v242
behavioral2/files/0x000a000000022e40-151.dat	aspack_v212_v242
behavioral2/files/0x000a000000022e40-153.dat	aspack_v212_v242
behavioral2/files/0x000a000000022e40-152.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
5104	rinst.exe
1108	DKcool.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe

Loads dropped DLL 3 IoCs

pid	Process
1108	DKcool.exe
1108	DKcool.exe
1108	DKcool.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DKcool = "C:\\WINDOWS\\system\\DKcool.exe"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	DKcool.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin"	DKcool.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\WINDOWS\system\DKcool.exe	rinst.exe
File created	C:\WINDOWS\system\DKcoolhk.dll	rinst.exe
File created	C:\WINDOWS\system\DKcoolwb.dll	rinst.exe
File created	C:\WINDOWS\system\rinst.exe	rinst.exe
File created	C:\WINDOWS\system\bpk.bin	rinst.exe
File opened for modification	C:\WINDOWS\system\bpk.bin	rinst.exe
File created	C:\WINDOWS\system\mc.dat	rinst.exe
File created	C:\WINDOWS\system\inst.dat	rinst.exe
File opened for modification	C:\WINDOWS\system\bpk.bin	DKcool.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	DKcool.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IESpy Class"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\WINDOWS\\system\\"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	DKcool.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	rinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\WINDOWS\\system\\DKcoolwb.dll"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1"	DKcool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID	DKcool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\WINDOWS\\system\\DKcoolwb.dll"	DKcool.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1108	DKcool.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1108	DKcool.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4904	OpenWith.exe
1108	DKcool.exe
1108	DKcool.exe
1108	DKcool.exe
1108	DKcool.exe
1108	DKcool.exe
1108	DKcool.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 5104	4396	bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe	79
PID 4396 wrote to memory of 5104	4396	bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe	79
PID 4396 wrote to memory of 5104	4396	bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe	79
PID 5104 wrote to memory of 1108	5104	rinst.exe	82
PID 5104 wrote to memory of 1108	5104	rinst.exe	82
PID 5104 wrote to memory of 1108	5104	rinst.exe	82
PID 1108 wrote to memory of 4432	1108	DKcool.exe	87
PID 1108 wrote to memory of 4432	1108	DKcool.exe	87
PID 1108 wrote to memory of 4432	1108	DKcool.exe	87

C:\Users\Admin\AppData\Local\Temp\bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe
"C:\Users\Admin\AppData\Local\Temp\bddcb8c3df1a05d71e07f853c895cc70cc8a9e288e5f0c3b20a0894671b54794.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\WINDOWS\system\DKcool.exe
    C:\WINDOWS\system\DKcool.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} about:blank
      4⤵
      PID:4432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DKcool.exe

Filesize
352KB

MD5
51532b1b43c2027f868bbebce59e0aae

SHA1
ee62926a8eb851ee3fd325fb4ea9c95e2e4f4cef

SHA256
cf048e7a13500420dd895028383d8d80a8dde445450817f6fd85f14419f07bdd

SHA512
0a3c85a4743df1c457a2f6584cea25a254a53a7777f8a2a3e7fab9860a5a58187a65673109fe0038526da5ddf9aa559a626360ce2bf2e6b000415d15c5713d36

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DKcoolhk.dll

Filesize
24KB

MD5
86286e5b355e56a7c556d0676682a17a

SHA1
69c4e83e655ef4795129092159ab8322d73d4e64

SHA256
9742d9c1a5b676894e215d0b154a710f6d0e2d8b61dc0dbcf21a1f6a194e7906

SHA512
1f84d342219d2beae329f7a98cde968147cd881c512b0129703d597f7a5c7a268e0b4d99434bb5957d78fc1b56cde2ae8d429534bb55fb7d8b29e7239fe46760

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DKcoolwb.dll

Filesize
21KB

MD5
a255b9cd274c4ecdb72a194bfdc46e84

SHA1
4c760758711d90e92a36db891eb15ea30dd74219

SHA256
fe32c2bba879777b5c52c2d35f1ca228b8b6a38ee8c61042eaf9a5cdd1324721

SHA512
5b18cb7282345eacc945aa119922771fb75733234e46cfcbc0bd005ed5c5e7b410a01a4014013c04075fb3ec6e2526528558c8ed7747cd4c3b8b88397ca1246d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSBot .27.rar

Filesize
351KB

MD5
a30b4c69a52468f868ccb404cb496b13

SHA1
16af1c22cde73937d1c51345376a67fbbfe83c68

SHA256
0a72d800e8bafdfb28da3e687fd389eb53dda3198c050b534ee968618aa85059

SHA512
805eaf916c86b650af456596614c4e95f938a73a2982af1c5337e860a33b3bbbc8bf4ed8385c82d6052d1de4351fc93ca5182e941a71b58ff3f25fd38d2eb6de

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.bin

Filesize
1KB

MD5
778ecce2b5248629cd73290ec6554423

SHA1
aafb64cee5fd43c7c85fa470509c33b8f0300a67

SHA256
8bea761a182082a94dfd9758366a3044d76656fc03c8ed00ead1bb657efb942b

SHA512
acbf7093a163ab8f7c6aad302038bd2f73aac3a2d24e84df4842f2832a95ee69052ac45d528c6955b67ebc349507d7c026a945832f0078eb568e2ae6a0dd2015

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat

Filesize
724B

MD5
2a05400633c041a15f0976f569e2ae5a

SHA1
5e446300a4e029d6189ab40b3da23c2f43ad3605

SHA256
c3aa31b6026baa6ecd854e5687e5b88d3c2b5a911bb3859fbf152c2913ecb610

SHA512
6ba45dcdd979a42e2a1eeff872d85c4f540db3d69e57be4b5ecbddffac6a75d9a8f62fa205256facf8af16454776ffea94ddb16f82e729d7ba2383c0c344f978

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mc.dat

Filesize
77B

MD5
da360fec771e2e8894db2b40f2ab73c3

SHA1
2d12806701b574270fc369b4de31b5db2d00a6ac

SHA256
fe5e76735e1190b3567a1ac1e11a8aafe0cdf5c682dca17cb09909e8c24761de

SHA512
e17ee29b732a3748a726124631c4fc14001ebbfc8a12537526450eec5ee82882108940e124608b87a14a7cec83cb59748e3c2f6fd0b0a421ebb23800ac04f9e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

Filesize
5KB

MD5
a7ce40bbc347d1a99400c6fe842948fa

SHA1
bc4a1901b3fa2a9cd0b9372c2dbdc14eb0976ff7

SHA256
92cc0b854fdfe3d2e94d2cecbe13833c41fffe1731ff66d13afd57f52e5d1755

SHA512
bb4764b6a718f2b708ee8842aa83dee1b01de88d5c2514b27cc9a409ca95bb04f00ecad26acbb890b922298f1e7e73d9fd30732f153dd34c3be8538e15e80396

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

Filesize
5KB

MD5
a7ce40bbc347d1a99400c6fe842948fa

SHA1
bc4a1901b3fa2a9cd0b9372c2dbdc14eb0976ff7

SHA256
92cc0b854fdfe3d2e94d2cecbe13833c41fffe1731ff66d13afd57f52e5d1755

SHA512
bb4764b6a718f2b708ee8842aa83dee1b01de88d5c2514b27cc9a409ca95bb04f00ecad26acbb890b922298f1e7e73d9fd30732f153dd34c3be8538e15e80396

Download Submit
C:\WINDOWS\system\DKcool.exe

Filesize
352KB

MD5
51532b1b43c2027f868bbebce59e0aae

SHA1
ee62926a8eb851ee3fd325fb4ea9c95e2e4f4cef

SHA256
cf048e7a13500420dd895028383d8d80a8dde445450817f6fd85f14419f07bdd

SHA512
0a3c85a4743df1c457a2f6584cea25a254a53a7777f8a2a3e7fab9860a5a58187a65673109fe0038526da5ddf9aa559a626360ce2bf2e6b000415d15c5713d36

Download Submit
C:\WINDOWS\system\DKcoolhk.dll

Filesize
24KB

MD5
86286e5b355e56a7c556d0676682a17a

SHA1
69c4e83e655ef4795129092159ab8322d73d4e64

SHA256
9742d9c1a5b676894e215d0b154a710f6d0e2d8b61dc0dbcf21a1f6a194e7906

SHA512
1f84d342219d2beae329f7a98cde968147cd881c512b0129703d597f7a5c7a268e0b4d99434bb5957d78fc1b56cde2ae8d429534bb55fb7d8b29e7239fe46760

Download Submit
C:\WINDOWS\system\DKcoolwb.dll

Filesize
21KB

MD5
a255b9cd274c4ecdb72a194bfdc46e84

SHA1
4c760758711d90e92a36db891eb15ea30dd74219

SHA256
fe32c2bba879777b5c52c2d35f1ca228b8b6a38ee8c61042eaf9a5cdd1324721

SHA512
5b18cb7282345eacc945aa119922771fb75733234e46cfcbc0bd005ed5c5e7b410a01a4014013c04075fb3ec6e2526528558c8ed7747cd4c3b8b88397ca1246d

Download Submit
C:\WINDOWS\system\bpk.bin

Filesize
1KB

MD5
778ecce2b5248629cd73290ec6554423

SHA1
aafb64cee5fd43c7c85fa470509c33b8f0300a67

SHA256
8bea761a182082a94dfd9758366a3044d76656fc03c8ed00ead1bb657efb942b

SHA512
acbf7093a163ab8f7c6aad302038bd2f73aac3a2d24e84df4842f2832a95ee69052ac45d528c6955b67ebc349507d7c026a945832f0078eb568e2ae6a0dd2015

Download Submit
C:\WINDOWS\system\inst.dat

Filesize
724B

MD5
2a05400633c041a15f0976f569e2ae5a

SHA1
5e446300a4e029d6189ab40b3da23c2f43ad3605

SHA256
c3aa31b6026baa6ecd854e5687e5b88d3c2b5a911bb3859fbf152c2913ecb610

SHA512
6ba45dcdd979a42e2a1eeff872d85c4f540db3d69e57be4b5ecbddffac6a75d9a8f62fa205256facf8af16454776ffea94ddb16f82e729d7ba2383c0c344f978

Download Submit
C:\WINDOWS\system\mc.dat

Filesize
77B

MD5
da360fec771e2e8894db2b40f2ab73c3

SHA1
2d12806701b574270fc369b4de31b5db2d00a6ac

SHA256
fe5e76735e1190b3567a1ac1e11a8aafe0cdf5c682dca17cb09909e8c24761de

SHA512
e17ee29b732a3748a726124631c4fc14001ebbfc8a12537526450eec5ee82882108940e124608b87a14a7cec83cb59748e3c2f6fd0b0a421ebb23800ac04f9e6

Download Submit
C:\WINDOWS\system\rinst.exe

Filesize
5KB

MD5
a7ce40bbc347d1a99400c6fe842948fa

SHA1
bc4a1901b3fa2a9cd0b9372c2dbdc14eb0976ff7

SHA256
92cc0b854fdfe3d2e94d2cecbe13833c41fffe1731ff66d13afd57f52e5d1755

SHA512
bb4764b6a718f2b708ee8842aa83dee1b01de88d5c2514b27cc9a409ca95bb04f00ecad26acbb890b922298f1e7e73d9fd30732f153dd34c3be8538e15e80396

Download Submit
C:\Windows\System\DKcool.exe

Filesize
352KB

MD5
51532b1b43c2027f868bbebce59e0aae

SHA1
ee62926a8eb851ee3fd325fb4ea9c95e2e4f4cef

SHA256
cf048e7a13500420dd895028383d8d80a8dde445450817f6fd85f14419f07bdd

SHA512
0a3c85a4743df1c457a2f6584cea25a254a53a7777f8a2a3e7fab9860a5a58187a65673109fe0038526da5ddf9aa559a626360ce2bf2e6b000415d15c5713d36

Download Submit
C:\Windows\System\DKcoolhk.dll

Filesize
24KB

MD5
86286e5b355e56a7c556d0676682a17a

SHA1
69c4e83e655ef4795129092159ab8322d73d4e64

SHA256
9742d9c1a5b676894e215d0b154a710f6d0e2d8b61dc0dbcf21a1f6a194e7906

SHA512
1f84d342219d2beae329f7a98cde968147cd881c512b0129703d597f7a5c7a268e0b4d99434bb5957d78fc1b56cde2ae8d429534bb55fb7d8b29e7239fe46760

Download Submit
C:\Windows\System\DKcoolwb.dll

Filesize
21KB

MD5
a255b9cd274c4ecdb72a194bfdc46e84

SHA1
4c760758711d90e92a36db891eb15ea30dd74219

SHA256
fe32c2bba879777b5c52c2d35f1ca228b8b6a38ee8c61042eaf9a5cdd1324721

SHA512
5b18cb7282345eacc945aa119922771fb75733234e46cfcbc0bd005ed5c5e7b410a01a4014013c04075fb3ec6e2526528558c8ed7747cd4c3b8b88397ca1246d

Download Submit
C:\Windows\System\DKcoolwb.dll

Filesize
21KB

MD5
a255b9cd274c4ecdb72a194bfdc46e84

SHA1
4c760758711d90e92a36db891eb15ea30dd74219

SHA256
fe32c2bba879777b5c52c2d35f1ca228b8b6a38ee8c61042eaf9a5cdd1324721

SHA512
5b18cb7282345eacc945aa119922771fb75733234e46cfcbc0bd005ed5c5e7b410a01a4014013c04075fb3ec6e2526528558c8ed7747cd4c3b8b88397ca1246d

Download Submit
memory/1108-154-0x0000000002FB0000-0x0000000002FBB000-memory.dmp

Filesize
44KB

Download
memory/1108-156-0x0000000002FB0000-0x0000000002FBB000-memory.dmp

Filesize
44KB

Download
memory/1108-157-0x0000000002FB0000-0x0000000002FBB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads