Analysis
-
max time kernel
142s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
14/06/2023, 07:06
General
-
Target
Komexo_KWI_2_0_7.exe
-
Size
6.8MB
-
MD5
4f9369c05918fad09e6c0cea18c44fae
-
SHA1
559535c7c912578200a98e5edff947c11ac92b5b
-
SHA256
cb6bd7bbd6cb3836ee9e02a5abd34e8bcc62c8e6e784d4f1fdef253d504eee0f
-
SHA512
877d8be12cd1d1d5f16aafe87b224e2d51cd9cbc1e1d0eb949ad383a7aaf7a02d8eea3ef8c6948ac8a734463217aa430e94515766353a0c2768b5e4d5b99f475
-
SSDEEP
196608:vbnAQOV6VPFcxGt5hx+ZHKpGbFOjPuDn0zb5khnnnaxH:DnAPoPF7z+bFcAn05khaxH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Komexo_KWI_2_0_7.exe"C:\Users\Admin\AppData\Local\Temp\Komexo_KWI_2_0_7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1SBHO.tmp\Komexo_KWI_2_0_7.tmp"C:\Users\Admin\AppData\Local\Temp\is-1SBHO.tmp\Komexo_KWI_2_0_7.tmp" /SL5="$70122,6800722,57856,C:\Users\Admin\AppData\Local\Temp\Komexo_KWI_2_0_7.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
84KB
-
Filesize
84KB