7aa0f33cae812fa6d364adf593d24e672f8179f5e941cb49df0d6701335c7447 | Triage

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 17:01

Sharing

Report Analysis Logs

General

Target

KingRoot PC v1.1/KingRoot.exe
Size

3.6MB
MD5

00a8eb3f0e1690db7b8db7a422a0ed3e
SHA1

9bb37771829c9d606ec8750b2b3b6094cc45fa6f
SHA256

52f242a655e1b0a41786b0ba256f9baef317b56ff7c724afe985e1252eeb68b1
SHA512

6b090fd1fa9ca564546951e5b7e00477b416d084ed552fee11aa88de544104c380215e9110df778cec279b3cbdbb499929b318618427faad4e2fe5c73cf8d7e3
SSDEEP

24576:q8ZFRW/lZtqQ7e9Fa83eGwB4tman+pomFoDoFxcYfwA:q8ZzuH38FwGMuman+pQoJI

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	KingRoot.exe
2096	KingRoot.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2312	2096	KingRoot.exe	28
PID 2096 wrote to memory of 2312	2096	KingRoot.exe	28
PID 2096 wrote to memory of 2312	2096	KingRoot.exe	28
PID 2096 wrote to memory of 2312	2096	KingRoot.exe	28
PID 2312 wrote to memory of 2860	2312	adb.exe	30
PID 2312 wrote to memory of 2860	2312	adb.exe	30
PID 2312 wrote to memory of 2860	2312	adb.exe	30
PID 2312 wrote to memory of 2860	2312	adb.exe	30

C:\Users\Admin\AppData\Local\Temp\KingRoot PC v1.1\KingRoot.exe
"C:\Users\Admin\AppData\Local\Temp\KingRoot PC v1.1\KingRoot.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\KingRoot PC v1.1\adb.exe
  "adb.exe" -d devices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\KingRoot PC v1.1\adb.exe
    adb fork-server server
    3⤵
    PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download