214d4769d5859e7f3ea12c98f00aee573c03700bd46661da0af9bd6a5b41f93a

Analysis

max time kernel
145s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KingRoot v1.3 2012.12.21.1805/KingRoot.exe
Size

5.3MB
MD5

80e6a330bd476e97bc0bb74a3a7ba514
SHA1

449425ac434c18104f18264c0f8821346f3f7953
SHA256

879ac3fa339baeaa77aec0795d20da8d40f93d81f067480f500d4f05ba5d5a18
SHA512

87f34a00c05dbc7ada766b3d40c9296bf425ec248b9d26ea6b0cf7678be0392f07832e53289fb816a49b9bd1015b5f48a24e0f528560b7e1615256f40b189f6f
SSDEEP

98304:I8aimlPSMaz6uf+xg+Rci2wRi2HeC1KDuy3L1JIC7vE:umM5cmPeC1KCy5SM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	KingRoot.exe
3044	KingRoot.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2992	3044	KingRoot.exe	28
PID 3044 wrote to memory of 2992	3044	KingRoot.exe	28
PID 3044 wrote to memory of 2992	3044	KingRoot.exe	28
PID 3044 wrote to memory of 2992	3044	KingRoot.exe	28
PID 2992 wrote to memory of 2848	2992	adb.exe	30
PID 2992 wrote to memory of 2848	2992	adb.exe	30
PID 2992 wrote to memory of 2848	2992	adb.exe	30
PID 2992 wrote to memory of 2848	2992	adb.exe	30

C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\KingRoot.exe
"C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\KingRoot.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\adb.exe
  "adb.exe" -d devices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\adb.exe
    adb fork-server server
    3⤵
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2848-2-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2992-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download