I7����Uؖ�R�;��l*=y����p���6�گ�; R/�����n�g����aߙ�mR+�m���W��b�W�M�3U'K�^�f\��M�6e>��azG�"KfC8P @l��i]*���S˭&���-$������= k;�=�A�6 MD�Y˹����f�s)�n8B0��l=Hi���z��*G�v�&�����LL���?���i���갶Y�S�R��ߠ ��06/صT���.P.4��KK�8��Y9��З�i�έ_D��U�IL�Ė<F2��ƣ���Z�h�J���/�20�?,�Q7~�����5��Z��g ��Y\��~Q�S0����7N�eS�\�L��R(q �ݙ>OD�l֞Ώ�qC�����H�9�*:�a�rs�1�K��1i����0L|u�z�?(���֎b���[��Za ��G��y�j���G��~Y�����n��kg������i�qj��c��6ŐF�/?M�j�_Z��2m�Ҝ����ʎ9̨0�~̝D�oiԤf �12�9+���IB߯�H����>C��ffq���\ ة���76+��b�*�a���%�{Y\R�b�2��m�ɺ�O��7����R����q#t�݁ZF��]�˱6����uHdx^��k�:̈�}����.:��=��J'0�t���{KȪㆀ��0����ȡ9ڐޙ^<0�+r�����Y�߸&h5��Xa�H��EO��Ұ����$���(��ϛ��p���E�.Տ�^��@��m����{ʂ��P�q��2s%�rZIBt��߆��U��A��M�nUz�)����7��)�#MT��}��2��U5�Q��\�6������+'����R�,P��x���O`7��*�[��M��>���g�n[���z��M����7Y�~���*��5�L�s�����5���u�\�5��Yz�K�^Z��_��p�� �$�]�(���1�����)�Or�J���H(�D�Vk/c�8$�����[�%(�W���ܞ��4�����(��j��Ulo����5��(��̪�_%;:�_q1���Y ���������6�"\P��˝-����u��UX��4�"HHԸ��pt���M��k�b ߚ z�X6��w��a�/�]s���0�b�����oep�f�oS*ψCڤ�k��F��w�:��&��Rp��Y��م�������Z���nx��O'�~�]��ؽ7V ǃ����s+�Y��;������M<�9}$��5����ԻH�������������!2�[�����"�N'),36GR�� �{ 6�L�{�+ҕ班~�����_�$�)`t���X���>�5?P�B�($=�wPB�a�5_X������eܠ�a��7�c�bt-.�Zl��Ӈ��=S���)��W�㬓N��X!r��N_��M�䋄�ǔ�d:���a���2����y/D�D n��-u!�1�)��5�����)��̄��u$�v^���@ �����ja{,YB��O�g�dW���;�Հt]�l��;��V!�"�{B����f�=D�!!1���0�Ҝ������ ���4��g+�:ңnictB!�ħa�u|֦�P���M�[��|�*܋>�qpW�[��AyPv��F�(�1�D��|�����rZ���P������x,v��� �>�r�s&[g/�*T�) ��K��Gɳ +���Sfa9����A2�r���O��u������uLk�\9C$,_:�̏� �cHW$n㍪��;��3��9oz�49�([!��Y7&3�.�&"���C`�/���T$��L�oJ.�(�_���,4}3wX״ �h?�9�X���?=.�0U Б�[Ze����\������\���ܷqSc����jg~��͔Ȅ�,S��㰕�*��f�o|̬�L�� ��`X����� +M���?�m��h/�a�̀��$Rs�Y�:S��"C�ch}h���zB8�wT��i������<�)�����j[JL�k�BPk>=�[�{�@��OA��ko���'�q��$��sb�m��s/u���8����;¬e�Y*��WbLd�f"�z�l%a�cK+Ɓ�{��fB����� ��9/��bQb�=Ɵ����O���%F\�I���3����0ւ�M�j�A�bo9�ǙsmY�1r�Y��Bf�S����Q��!j���kl�CDX�0�f�!�nm�dI�;l���t�H1��k���XÈ ��7Y�e�S��ȒrU(�&���I\���R�U�2�����{����LJ�)J� �&���>!Z�uA���C��&���*�>M^�� ,d]�[�Ǫ�w��m�w#za���t%�sTj9�Z�E��L^|_�^�ɋ-oh߫�V �`�E�����[/�rq��g����4�_�|'����or�e�Z�\7��:�xV��D�u� �J���t�أ�4��[lb�Ή́*ƤJg�T8ޞ���&���4g��^ao-� r;�)(���@�o�s�/0jj�+�H�*O��!��'�EZ�9�j�"�J�6,�5%�S�U���\NnP����Y"����o=%�R�LhG�KnyV�[}��`��z1���OGE��C�$��As��k�µm�%j�DX}&�H�V#�0u����WNO:���!p�2�d0TPq?/CX��܍ r5m���$�ڒ�) �Y�Ǔ}Wh����r�̚^����d�PTJ�3����:�\Jf@�� ���%M=��Rb :a13{>�_��b^=����,/a����� r�]ʫ��eL�}�c�%O��6�ֆ�_�f��E�(p7�uF�L|�5w���=*;��+���_�ޢ�`Cq�:��"�?51��g�m� �������M1eE������o-ҏ�����4�C��(d�Y�e�j�{�_M�t"4���ؕ�(�@��p���W�����5!��]�T��R�''T,�}�𰀯�O���8&%��PA ��(����9q�P�����_���8�2�=�cW���P�:���p"]�{/�h?d�o�����/��`v�����:�
Static task
static1
Behavioral task
behavioral1
Sample
KKebi.Launcher.exe
Resource
win10v2004-20230220-en
General
-
Target
KKebi.Launcher.exe
-
Size
51.2MB
-
MD5
717984163fb192c0a3c63cd6b17b9542
-
SHA1
e0d3587437a959234d3afbfcd713c15ef6264aec
-
SHA256
b6da666b77de287ab2b23c3a3df84876a07534a2382636a519a6377c00cb8211
-
SHA512
48ea089ff2f7422670cc7868ca1d03130e077ea99b82620e5114f0477d004e953fd4abb4bfde87cda5612d4d6e9437c9a4758a80123bb5815245789e62369603
-
SSDEEP
98304:ZLCYblaAo9l2iuzNyCwubWhAhrWLqdHCIvkU7L/7lFatcVtchWlWqpASFeUtitOS:69ExzsCwuyA0+7PJeqpAgIFs6
Malware Config
Signatures
Files
-
KKebi.Launcher.exe.exe windows x64
dc3cbc915db2f35b4dfa4f0d3639a26c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteExW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: 48.4MB - Virtual size: 48.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ