Resubmissions
16/09/2023, 10:59
230916-m3fc8aaa4v616/09/2023, 10:55
230916-m1lr8aaa3v616/09/2023, 10:55
230916-m1b8saaa21316/09/2023, 10:54
230916-mzqd1saa2v316/09/2023, 10:50
230916-mxh7xscg636Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
16/09/2023, 10:59
General
- Target Kiwi X Keyless.exe
- Size 3.8MB
- Sample230916-m3fc8aaa4v
- SHA256 3858a5f8d3581143629676a6fccc07d3b9555a32fa0871557be71c78cb4452ae
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kiwi X Keyless.exe"C:\Users\Admin\AppData\Local\Temp\Kiwi X Keyless.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 18242⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab4730.tmp
Tar4771.tmp
memory/2060-4-0x0000000000CA0000-0x0000000000CE0000-memory.dmp
memory/2060-41-0x0000000000CA0000-0x0000000000CE0000-memory.dmp
memory/2060-0-0x00000000000C0000-0x0000000000488000-memory.dmp
memory/2060-5-0x00000000008F0000-0x00000000008FA000-memory.dmp
memory/2060-6-0x00000000008F0000-0x00000000008FA000-memory.dmp
memory/2060-2-0x0000000000CA0000-0x0000000000CE0000-memory.dmp
memory/2060-1-0x0000000074AF0000-0x00000000751DE000-memory.dmp
memory/2060-3-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/2060-42-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/2060-43-0x0000000074AF0000-0x00000000751DE000-memory.dmp
memory/2060-44-0x0000000000CA0000-0x0000000000CE0000-memory.dmp
memory/2060-45-0x0000000000CA0000-0x0000000000CE0000-memory.dmp
memory/2060-46-0x00000000008F0000-0x00000000008FA000-memory.dmp
memory/2060-47-0x00000000008F0000-0x00000000008FA000-memory.dmp