General
-
Target
KMSpico.exe
-
Size
3.5MB
-
Sample
230209-pgtd3abe8z
-
MD5
34e53fd5d5b3534989b6b94c52d9d52a
-
SHA1
d4a166025f313d6a03ee9c52e025fc3bbf55014e
-
SHA256
bb39616af00afba184ec39118d17080a9c1b47e6d044fd7b850dde5903d929c4
-
SHA512
3de85bb1687d2e8fad0f68b27efedefa3a9bb7c8ddfc3bb0a6b8103d2d83563a8e6a69076d6276a8f39f526fac00a177e68f551ff7e1924250c1b3016e7d676a
-
SSDEEP
98304:zBC/1XczAVcz5iituNDynYX6KUXNnbe8awz:zcN/VOfYN+YX6KUXNnq8z
Behavioral task
behavioral1
Sample
KMSpico.exe
Resource
win7-20221111-en
Malware Config
Extracted
vidar
2.4
14
-
profile_id
14
Targets
-
-
Target
KMSpico.exe
-
Size
3.5MB
-
MD5
34e53fd5d5b3534989b6b94c52d9d52a
-
SHA1
d4a166025f313d6a03ee9c52e025fc3bbf55014e
-
SHA256
bb39616af00afba184ec39118d17080a9c1b47e6d044fd7b850dde5903d929c4
-
SHA512
3de85bb1687d2e8fad0f68b27efedefa3a9bb7c8ddfc3bb0a6b8103d2d83563a8e6a69076d6276a8f39f526fac00a177e68f551ff7e1924250c1b3016e7d676a
-
SSDEEP
98304:zBC/1XczAVcz5iituNDynYX6KUXNnbe8awz:zcN/VOfYN+YX6KUXNnq8z
-
Blocklisted process makes network request
-
Creates new service(s)
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-