Analysis Overview
SHA256
27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54
Threat Level: Known bad
The file krnl_bootstrapper.exe.bin was found to be: Known bad.
Malicious Activity Summary
Detects Redline Stealer samples
Lumma Stealer
RedLine
Downloads MZ/PE file
Loads dropped DLL
Executes dropped EXE
Enumerates physical storage devices
Program crash
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-04-30 22:18
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-04-30 22:18
Reported
2023-04-30 22:34
Platform
win7-20230220-en
Max time kernel
60s
Max time network
106s
Command Line
Signatures
Detects Redline Stealer samples
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Lumma Stealer
RedLine
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| N/A | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| N/A | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Loads dropped DLL
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: 35 | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: 35 | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Documents\krnl\krnlss.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Users\Admin\Documents\krnl\krnlss.exe
"C:\Users\Admin\Documents\krnl\krnlss.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdn.krnl.place | udp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 8.8.8.8:53 | k-storage.com | udp |
| US | 188.114.97.0:443 | k-storage.com | tcp |
| US | 188.114.97.0:443 | k-storage.com | tcp |
| US | 8.8.8.8:53 | sslcom.repository.certum.pl | udp |
| NL | 95.101.74.146:80 | sslcom.repository.certum.pl | tcp |
Files
memory/2040-54-0x0000000000110000-0x000000000023A000-memory.dmp
memory/2040-56-0x00000000004A0000-0x00000000004AA000-memory.dmp
memory/2040-55-0x0000000002300000-0x0000000002340000-memory.dmp
memory/2040-57-0x00000000008C0000-0x00000000008CA000-memory.dmp
\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\Monaco.zip
| MD5 | 1a19fd7c42169c76e75e685dca02c190 |
| SHA1 | f16b4697bcd348d44965bf9ded731523db9bd606 |
| SHA256 | d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331 |
| SHA512 | 93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4 |
\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\src.7z
| MD5 | 7c380ecd5bc2cd51511d0ee5b58df745 |
| SHA1 | 615749979477621579dd9b04ada8d4dcd9430f1e |
| SHA256 | 38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07 |
| SHA512 | 110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de |
memory/2040-119-0x0000000002300000-0x0000000002340000-memory.dmp
memory/2040-118-0x0000000002300000-0x0000000002340000-memory.dmp
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
C:\Users\Admin\Documents\krnl\krnlss.exe.config
| MD5 | 0ed4b3831ff5e91dff636145f68aac4c |
| SHA1 | 2d1140812945dc1b9e400a88c911803639cb2e49 |
| SHA256 | 03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347 |
| SHA512 | 4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c |
C:\Users\Admin\Documents\krnl\krnlss.exe
| MD5 | 4d7c519cc2127f785d13694d7a281f33 |
| SHA1 | 6d5d49494ca03fb99f7124197296d43c68d0c027 |
| SHA256 | 6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5 |
| SHA512 | 50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5 |
memory/2020-574-0x00000000010C0000-0x0000000001244000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabAAB4.tmp
| MD5 | fc4666cbca561e864e7fdf883a9e6661 |
| SHA1 | 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5 |
| SHA256 | 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b |
| SHA512 | c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d |
C:\Users\Admin\AppData\Local\Temp\TarAAC6.tmp
| MD5 | 73b4b714b42fc9a6aaefd0ae59adb009 |
| SHA1 | efdaffd5b0ad21913d22001d91bf6c19ecb4ac41 |
| SHA256 | c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd |
| SHA512 | 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 3ac860860707baaf32469fa7cc7c0192 |
| SHA1 | c33c2acdaba0e6fa41fd2f00f186804722477639 |
| SHA256 | d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904 |
| SHA512 | d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c |
C:\Users\Admin\AppData\Local\Temp\TarADEA.tmp
| MD5 | 4ff65ad929cd9a367680e0e5b1c08166 |
| SHA1 | c0af0d4396bd1f15c45f39d3b849ba444233b3a2 |
| SHA256 | c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6 |
| SHA512 | f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/2020-760-0x0000000000C80000-0x0000000000CBE000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/2020-763-0x0000000000C80000-0x0000000000CBE000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/2020-764-0x0000000000DD0000-0x0000000000E10000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.dll
| MD5 | 5f79e7737e5e8be2cf8711374c114e85 |
| SHA1 | 86eabaa284074dd2f86f856cea043061091897ef |
| SHA256 | 5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72 |
| SHA512 | 41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95 |
memory/2020-765-0x0000000005930000-0x00000000059EA000-memory.dmp
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
memory/2020-769-0x00000000069C0000-0x0000000006B0D000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
memory/2020-772-0x00000000069C0000-0x0000000006B0D000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll
| MD5 | c7430597fb837d6bc7549b988bdc78a5 |
| SHA1 | 447d90f6cad3afe3d2c47fd45f730c68d3201990 |
| SHA256 | 531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88 |
| SHA512 | 41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1 |
C:\Users\Admin\Documents\krnl\bin\src\libcef.dll
| MD5 | 8c51876f1b5dfbf4964732a65c1f2724 |
| SHA1 | ed5653a3a5655ba65d6221285da93799bd2517f9 |
| SHA256 | 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e |
| SHA512 | a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884 |
\Users\Admin\Documents\krnl\bin\src\libcef.dll
| MD5 | 8c51876f1b5dfbf4964732a65c1f2724 |
| SHA1 | ed5653a3a5655ba65d6221285da93799bd2517f9 |
| SHA256 | 5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e |
| SHA512 | a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884 |
C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll
| MD5 | 6499ea6b92ab4971886bd06c12625819 |
| SHA1 | 5ebb75eeca7625b9511233158a02f50a92867a39 |
| SHA256 | 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b |
| SHA512 | e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d |
\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll
| MD5 | 6499ea6b92ab4971886bd06c12625819 |
| SHA1 | 5ebb75eeca7625b9511233158a02f50a92867a39 |
| SHA256 | 6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b |
| SHA512 | e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d |
memory/2020-784-0x00000000051A0000-0x00000000051AE000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
memory/2020-781-0x00000000051A0000-0x00000000051AE000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll
| MD5 | 5e5fe029bff022007c27d024ae7cf262 |
| SHA1 | fb7250ec8ca1acd36023b966fae61e85fe2c8ab4 |
| SHA256 | 7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b |
| SHA512 | 60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216 |
memory/2020-791-0x0000000005320000-0x000000000532E000-memory.dmp
memory/2020-788-0x0000000005320000-0x000000000532E000-memory.dmp
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll
| MD5 | 103d84c4a22967defcbedaea6e11720f |
| SHA1 | f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2 |
| SHA256 | 7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2 |
| SHA512 | 410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7 |
memory/2020-792-0x0000000000DD0000-0x0000000000E10000-memory.dmp
\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
memory/2020-796-0x00000000054E0000-0x0000000005522000-memory.dmp
\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll
| MD5 | 2ecb51ab00c5f340380ecf849291dbcf |
| SHA1 | 1a4dffbce2a4ce65495ed79eab42a4da3b660931 |
| SHA256 | f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf |
| SHA512 | e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b |
memory/2020-797-0x0000000000DD0000-0x0000000000E10000-memory.dmp
C:\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
\Users\Admin\Documents\krnl\ScintillaNET.dll
| MD5 | 9166536c31f4e725e6befe85e2889a4b |
| SHA1 | f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae |
| SHA256 | ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163 |
| SHA512 | 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562 |
memory/2020-801-0x0000000007D80000-0x0000000007ED4000-memory.dmp
\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll
| MD5 | 2ff7acfa80647ee46cc3c0e446327108 |
| SHA1 | c994820d03af722c244b046d1ee0967f1b5bc478 |
| SHA256 | 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d |
| SHA512 | 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd |
memory/2020-805-0x0000000000DD0000-0x0000000000E10000-memory.dmp
memory/2020-806-0x0000000000DD0000-0x0000000000E10000-memory.dmp
memory/2020-807-0x0000000000DD0000-0x0000000000E10000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-04-30 22:18
Reported
2023-04-30 22:34
Platform
win10v2004-20230220-en
Max time kernel
135s
Max time network
153s
Command Line
Signatures
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: 35 | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\Documents\krnl\7za.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1816 wrote to memory of 3860 | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | C:\Users\Admin\Documents\krnl\7za.exe |
| PID 1816 wrote to memory of 3860 | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | C:\Users\Admin\Documents\krnl\7za.exe |
| PID 1816 wrote to memory of 3860 | N/A | C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe | C:\Users\Admin\Documents\krnl\7za.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1816 -ip 1816
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 2428
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.krnl.place | udp |
| US | 66.228.51.4:443 | cdn.krnl.place | tcp |
| US | 8.8.8.8:53 | 42.220.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | k-storage.com | udp |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 8.8.8.8:53 | 4.51.228.66.in-addr.arpa | udp |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 8.8.8.8:53 | 0.96.114.188.in-addr.arpa | udp |
| US | 188.114.97.0:443 | k-storage.com | tcp |
| US | 52.152.110.14:443 | tcp | |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 52.182.141.63:443 | tcp | |
| NL | 173.223.113.164:443 | tcp | |
| US | 204.79.197.203:80 | tcp | |
| US | 52.152.110.14:443 | tcp | |
| US | 8.8.8.8:53 | 63.13.109.52.in-addr.arpa | udp |
| US | 13.107.4.50:80 | tcp | |
| US | 52.152.110.14:443 | tcp | |
| US | 188.114.96.0:443 | k-storage.com | tcp |
| US | 52.152.110.14:443 | tcp | |
| US | 52.152.110.14:443 | tcp | |
| US | 52.152.110.14:443 | tcp |
Files
memory/1816-133-0x0000000000450000-0x000000000057A000-memory.dmp
memory/1816-134-0x0000000002A00000-0x0000000002A10000-memory.dmp
memory/1816-135-0x00000000097B0000-0x00000000097B8000-memory.dmp
memory/1816-136-0x0000000009880000-0x00000000098B8000-memory.dmp
memory/1816-137-0x0000000009860000-0x000000000986E000-memory.dmp
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\7za.exe
| MD5 | ec79cabd55a14379e4d676bb17d9e3df |
| SHA1 | 15626d505da35bfdb33aea5c8f7831f616cabdba |
| SHA256 | 44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d |
| SHA512 | 00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47 |
C:\Users\Admin\Documents\krnl\bin\Monaco.zip
| MD5 | 1a19fd7c42169c76e75e685dca02c190 |
| SHA1 | f16b4697bcd348d44965bf9ded731523db9bd606 |
| SHA256 | d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331 |
| SHA512 | 93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4 |