e707c96f2e870ec45a56fa37a8c25dbe1116467e74a7432a8d9992a2bc6e28ca

Analysis

max time kernel
131s
max time network
136s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KORG_Keygen.exe
Size

752KB
MD5

abfb1104e1c320ea33cc2c4ffc4049b0
SHA1

dd2d5f59bc4e6a1bfcd6c6e10203927c66046730
SHA256

e707c96f2e870ec45a56fa37a8c25dbe1116467e74a7432a8d9992a2bc6e28ca
SHA512

e896675cf055dc91c1e1604bfb79c69b2989e6f794816940a47b8f5249186293c1582ac7bcaf9494da0f499d1080be09a40434e023acda067c299776953d8dd2
SSDEEP

12288:Uc9t2SllJFE4S/+c/SWhw9eNH7ew6sURifmLB7Ag50ffqSm1PZKNcRFQ6fJy8uvg:UcLjFDsZdK9eNH7E50fU5SfQlZgiTv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2612	keygen.exe

Loads dropped DLL 4 IoCs

pid	Process
884	KORG_Keygen.exe
884	KORG_Keygen.exe
2612	keygen.exe
2612	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2612	884	KORG_Keygen.exe	28
PID 884 wrote to memory of 2612	884	KORG_Keygen.exe	28
PID 884 wrote to memory of 2612	884	KORG_Keygen.exe	28
PID 884 wrote to memory of 2612	884	KORG_Keygen.exe	28

C:\Users\Admin\AppData\Local\Temp\KORG_Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\KORG_Keygen.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RKORGKG.dll

Filesize
282KB

MD5
6d735cad58a8411b341358b8ce916c10

SHA1
a210837b2db291d409ee91bc789f81fea3239c57

SHA256
4def01a0f752bca2d91cd3462ed68dac3f4a07b1af74a4c48ec2ef93d69dc506

SHA512
d8a0ea7d94fabf9ad0f8352e466b22d57fade888c0f7da426b2f564c09f20c2bcc9148c5864930f0d7a1601cb054ec4d44e04f3ef2440b0ea8149919efabfb4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgm.xm

Filesize
493KB

MD5
84d09a89de4998aad278ef8dbb9be982

SHA1
7344c02171aa5c2e2c979d83a9faae1be444de40

SHA256
f4e6e08e4a8d34aba80d7d1f98163088aef9635fcc72203248381b6e7fa20440

SHA512
984e09556cf3cf3e03051a84ece6bb25383f6f249d4ef6042375ed6d254b9d84045202ef38de854c6adaefa9b6bfe87eccfdd8cb3cef71e69f6b6cddada87b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
540KB

MD5
138b7ec7daf73780d9ae3b7f0d336d5e

SHA1
cc3a6c5fccfdd0dc4a964ab50056a8ad6a33fd1a

SHA256
8c36d17afe5bf33bbdc5f07744ff5be75d7a41d9b4a53b0d34607a3c29149799

SHA512
7f3a5df54ef11f01f845f3820629b639c7e7bc9c12daa55f2ad92aaacf4f61eb35e05b506a96d37a1ca268ebf8fb3675d1888be53ad86e5d002329a729ce4c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
540KB

MD5
138b7ec7daf73780d9ae3b7f0d336d5e

SHA1
cc3a6c5fccfdd0dc4a964ab50056a8ad6a33fd1a

SHA256
8c36d17afe5bf33bbdc5f07744ff5be75d7a41d9b4a53b0d34607a3c29149799

SHA512
7f3a5df54ef11f01f845f3820629b639c7e7bc9c12daa55f2ad92aaacf4f61eb35e05b506a96d37a1ca268ebf8fb3675d1888be53ad86e5d002329a729ce4c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
540KB

MD5
138b7ec7daf73780d9ae3b7f0d336d5e

SHA1
cc3a6c5fccfdd0dc4a964ab50056a8ad6a33fd1a

SHA256
8c36d17afe5bf33bbdc5f07744ff5be75d7a41d9b4a53b0d34607a3c29149799

SHA512
7f3a5df54ef11f01f845f3820629b639c7e7bc9c12daa55f2ad92aaacf4f61eb35e05b506a96d37a1ca268ebf8fb3675d1888be53ad86e5d002329a729ce4c3e

Download Submit
\Users\Admin\AppData\Local\Temp\BASSMOD.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
\Users\Admin\AppData\Local\Temp\R2RKORGKG.dll

Filesize
282KB

MD5
6d735cad58a8411b341358b8ce916c10

SHA1
a210837b2db291d409ee91bc789f81fea3239c57

SHA256
4def01a0f752bca2d91cd3462ed68dac3f4a07b1af74a4c48ec2ef93d69dc506

SHA512
d8a0ea7d94fabf9ad0f8352e466b22d57fade888c0f7da426b2f564c09f20c2bcc9148c5864930f0d7a1601cb054ec4d44e04f3ef2440b0ea8149919efabfb4c

Download Submit
\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
540KB

MD5
138b7ec7daf73780d9ae3b7f0d336d5e

SHA1
cc3a6c5fccfdd0dc4a964ab50056a8ad6a33fd1a

SHA256
8c36d17afe5bf33bbdc5f07744ff5be75d7a41d9b4a53b0d34607a3c29149799

SHA512
7f3a5df54ef11f01f845f3820629b639c7e7bc9c12daa55f2ad92aaacf4f61eb35e05b506a96d37a1ca268ebf8fb3675d1888be53ad86e5d002329a729ce4c3e

Download Submit
\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
540KB

MD5
138b7ec7daf73780d9ae3b7f0d336d5e

SHA1
cc3a6c5fccfdd0dc4a964ab50056a8ad6a33fd1a

SHA256
8c36d17afe5bf33bbdc5f07744ff5be75d7a41d9b4a53b0d34607a3c29149799

SHA512
7f3a5df54ef11f01f845f3820629b639c7e7bc9c12daa55f2ad92aaacf4f61eb35e05b506a96d37a1ca268ebf8fb3675d1888be53ad86e5d002329a729ce4c3e

Download Submit
memory/2612-31-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-16-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2612-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-26-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-18-0x0000000000250000-0x000000000029A000-memory.dmp

Filesize
296KB

Download
memory/2612-28-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-30-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-23-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-32-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-33-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2612-34-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download