8dc91aa52f719ff1a71e7a8dab4b5e68416de0c5212bb987c43f7701f98907a9 | Triage

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 07:55

Sharing

Report Analysis Logs

General

Target

kingbill.exe
Size

3.9MB
MD5

0dd59b9044d93ddeb3201fe3a68f7e42
SHA1

8ebc282599e9b623bcc489898ee022ae690e90a9
SHA256

8dc91aa52f719ff1a71e7a8dab4b5e68416de0c5212bb987c43f7701f98907a9
SHA512

2e2614ca619227fd63aa30a3954326c5df5b1a127c74eefd8aee33945ba81587bec99df13e2681cafb31a25c7e15c743d49c439763a22a3d80d6fa673ad54a7d
SSDEEP

98304:q1jIX2tG/oMvEsmyM1TEEMGXSGwv5ASaFLZlzPsYGL3rnUMw:qhIGWoMR3GCGwvsFLLQs

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

kingbill.exe

pid process

3940 kingbill.exe
3940 kingbill.exe
3940 kingbill.exe
3940 kingbill.exe
3940 kingbill.exe

C:\Users\Admin\AppData\Local\Temp\kingbill.exe
"C:\Users\Admin\AppData\Local\Temp\kingbill.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-133-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/3940-134-0x0000000000400000-0x00000000014FB000-memory.dmp

Filesize
17.0MB

Download
memory/3940-135-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download