Overview
overview
3Static
static
3InfoRelease.exe
windows7-x64
1InfoRelease.exe
windows10-2004-x64
1KTBusiness.dll
windows7-x64
1KTBusiness.dll
windows10-2004-x64
1KTCommon.dll
windows7-x64
1KTCommon.dll
windows10-2004-x64
1KTControl.dll
windows7-x64
1KTControl.dll
windows10-2004-x64
1KTEntity.dll
windows7-x64
1KTEntity.dll
windows10-2004-x64
1KTTools.dll
windows7-x64
1KTTools.dll
windows10-2004-x64
1KtPlayer.exe
windows7-x64
1KtPlayer.exe
windows10-2004-x64
1VideoPlayer.exe
windows7-x64
1VideoPlayer.exe
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
InfoRelease.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
InfoRelease.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
KTBusiness.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
KTBusiness.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
KTCommon.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
KTCommon.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
KTControl.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
KTControl.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
KTEntity.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
KTEntity.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
KTTools.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
KTTools.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
KtPlayer.exe
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
KtPlayer.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
VideoPlayer.exe
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
VideoPlayer.exe
Resource
win10v2004-20230915-en
General
-
Target
InfoRelease.exe
-
Size
1.1MB
-
MD5
999596281b589653039e535b142fda49
-
SHA1
3c2898f2b6fd3120386323c58929ea14fda87140
-
SHA256
c6c73c60a5eabade6668fc8653d3a57ba300cec9cec0a891b7f52b649b3035ce
-
SHA512
0425c6b9215399fc4b215bb0c04fa7f692ae2fc61131d9b6d189597d9db139b33e22d9a45e762d02ead67a72a9dc7d6093caa3ef79d5dd452c5b588495d29c39
-
SSDEEP
24576:s8nx+uJjHCUobZ56HNmqY5IQtnQIVly7u6rN2SSSSfTx+:s8n7EbLkNmJ5R+kkpqT
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe 1864 InfoRelease.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1864 InfoRelease.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 InfoRelease.exe