Overview
overview
7Static
static
7HKeyboard.dll
windows7-x64
1HKeyboard.dll
windows10-1703-x64
1HKeyboard.dll
windows10-2004-x64
1KS.exe
windows7-x64
6KS.exe
windows10-1703-x64
6KS.exe
windows10-2004-x64
6_sogou_pin...11.exe
windows7-x64
7_sogou_pin...11.exe
windows10-1703-x64
7_sogou_pin...11.exe
windows10-2004-x64
7Resubmissions
25-08-2023 15:01
230825-sdyfdseg2t 7Analysis
-
max time kernel
138s -
max time network
310s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2023 15:01
Behavioral task
behavioral1
Sample
HKeyboard.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
HKeyboard.dll
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
HKeyboard.dll
Resource
win10v2004-20230824-en
Behavioral task
behavioral4
Sample
KS.exe
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
KS.exe
Resource
win10-20230703-en
Behavioral task
behavioral6
Sample
KS.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
_sogou_pinyin_Release_13.8.0.8160_1111.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
_sogou_pinyin_Release_13.8.0.8160_1111.exe
Resource
win10-20230703-en
Behavioral task
behavioral9
Sample
_sogou_pinyin_Release_13.8.0.8160_1111.exe
Resource
win10v2004-20230703-en
General
-
Target
KS.exe
-
Size
135KB
-
MD5
6124c9b0e9f2c24878a19e167469da4a
-
SHA1
8a1813a862f3522f62f1f33cff6ce285f71406c6
-
SHA256
3a4db4165bd1b66f7bcc477e0bac2c872b57b2a16799be2b4e796465e390ebad
-
SHA512
3ee7b82fabc3febfb95c086f3e2488e6ae98c159829701323a4e44cf182e8f8ff3b2580c18874f616a4851ba3c830c476ddb0c8db8154ca384cb983f986b1926
-
SSDEEP
1536:hdQ3GllQsoaIEFgStIcoHFqidn7cr5NAzbYvwvfb6YfqpeBCosqrHhlUE+oMFMG4:hdrlmsoZHmFIp
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
KS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gKQYSEV = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\KS.exe\"" KS.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
KS.exepid process 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe 4484 KS.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
KS.exepid process 4484 KS.exe 4484 KS.exe