Analysis
-
max time kernel
54s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-de -
resource tags
arch:x64arch:x86image:win10v2004-20221111-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
07/02/2023, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
KakaoTalk_Setup_0654478763.exe
Resource
win7-20220812-de
windows7-x64
0 signatures
150 seconds
General
-
Target
KakaoTalk_Setup_0654478763.exe
-
Size
2.9MB
-
MD5
85d03cef0650f1de5892f5b8f6ffa071
-
SHA1
8c6f91a2422af072116694d4e0571fd41fc91d8f
-
SHA256
69f3d3cff5d4fba761fc3f7428bc1ef12fd00f4c0ea4005dbc884ffa43ca1eb1
-
SHA512
b5e747faf52b5a29c1b0dd9127f9fcb26a56b4aa9bb9b21edbbd7bd9b9a05933fb8b81ea7698ab8e60f2789d3d5094ee9b63db90e87efecd9e39c687fd192139
-
SSDEEP
49152:b7YO2rebc5AQEybcH3SFUph5sGBp2KSf6eAAWVkBKBW2aM8HmoXw3:vsN7EybcC+ph53psf6rnkBKcQ8HmoXQ
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2440 1012 WerFault.exe 101 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 KakaoTalk_Setup_0654478763.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 KakaoTalk_Setup_0654478763.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS KakaoTalk_Setup_0654478763.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS KakaoTalk_Setup_0654478763.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 4912 taskmgr.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 868 KakaoTalk_Setup_0654478763.exe 868 KakaoTalk_Setup_0654478763.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeShutdownPrivilege 2092 KakaoTalk_Setup_0654478763.exe Token: SeCreatePagefilePrivilege 2092 KakaoTalk_Setup_0654478763.exe Token: SeDebugPrivilege 4912 taskmgr.exe Token: SeSystemProfilePrivilege 4912 taskmgr.exe Token: SeCreateGlobalPrivilege 4912 taskmgr.exe Token: 33 4912 taskmgr.exe Token: SeIncBasePriorityPrivilege 4912 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2092 KakaoTalk_Setup_0654478763.exe 2092 KakaoTalk_Setup_0654478763.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2092 wrote to memory of 868 2092 KakaoTalk_Setup_0654478763.exe 86 PID 2092 wrote to memory of 868 2092 KakaoTalk_Setup_0654478763.exe 86 PID 2092 wrote to memory of 868 2092 KakaoTalk_Setup_0654478763.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\KakaoTalk_Setup_0654478763.exe"C:\Users\Admin\AppData\Local\Temp\KakaoTalk_Setup_0654478763.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\KakaoTalk_Setup_0654478763.exe"C:\Users\Admin\AppData\Local\Temp\KakaoTalk_Setup_0654478763.exe" /_ShowProgress /PrTxt:TG9hZGluZy4uLg== /mnl2⤵
- Suspicious behavior: EnumeratesProcesses
PID:868
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 460 -p 1012 -ip 10121⤵PID:1488
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1012 -s 29081⤵
- Program crash
PID:2440
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5800eabf55778cc35d894d165b378b04e
SHA19c49ab6c8a6927498dc50c1c2c821cadff61df5f
SHA256d252d06211167ee8cf442a7bf2dea92addc2edc497cd5ab00afe57414a81038f
SHA512c5b05c9572e8855cf641d77800e73da029e09ceb660291f54975af2de0eff2a81a5081f557298bcf20ba2271185519b819a964bb2002dd208a9f89a68b1be228
-
Filesize
330KB
MD561cffdde659367c1b8852cc9dbe50068
SHA104a880c4ae1588e4deaad489e4008bf090f55913
SHA256ad67cbc56e500b24a297830cea6e4131b4f30ee9184a26751cc416a24fe2c87f
SHA5123c6e9390c5a852efd900299c0bcc403434307a86eba05d725f8df49b7660c5962a585ea19e1b51aa31e422e01389e0bfab6d81925c6d9273be2015c2a9b6e9b2