Resubmissions
28/12/2023, 15:39
231228-s3k7csafgr 7Analysis
-
max time kernel
156s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28/12/2023, 15:39
General
-
Target
Kayflockmp4_1.exe
-
Size
15.4MB
-
MD5
eb5e92ece01989e0d5070f6306cc69c9
-
SHA1
d4882d0d0dfbc9326c944f779131d11880e913ea
-
SHA256
91abcd48958ffd621f1068c52dc0d86dc9baf1781e3b4e73e4c44a5c0887d7d1
-
SHA512
bd060afeffc65f391a19c1dbceb3d301385088dfe6c74cd913343383809eec3d3cb6dbf4f54bd12be72c6449987eb40b7692155ef2c4efee51194cf65d1352e5
-
SSDEEP
393216:uWvz+XOVV63etEL+9qzT7Ck+7q301Jc1bWXdWCUI:Pz+XOLI+9q/Z301QcVUI
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Loads dropped DLL 50 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kayflockmp4_1.exe"C:\Users\Admin\AppData\Local\Temp\Kayflockmp4_1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kayflockmp4_1.exe"C:\Users\Admin\AppData\Local\Temp\Kayflockmp4_1.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91B
MD55aa796b6950a92a226cc5c98ed1c47e8
SHA16706a4082fc2c141272122f1ca424a446506c44d
SHA256c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
-
Filesize
23B
MD55638715e9aaa8d3f45999ec395e18e77
SHA14e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA2564db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
SHA51278c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b
-
Filesize
10KB
MD5c910335164bf49879465efd2eb1bca37
SHA11624a99e084ce636094e1009e6214b305659a119
SHA256e8ffbf24cc5c0d8a423445a0503377f2a908149b4f38b1d505a8c9661922006e
SHA5125074dd1eca39ee10c226f1217682cae2488c4a9d318633b2d0d135ff8d2267599cb1a45f0e648ebd2fb7cd5f4fffee5ecd828bf49a8eadbfec4ade733234a990
-
Filesize
10KB
MD514271052e8b7845f6033085a1a056d14
SHA178794e19690243ab042c7badbc928064f1783f1f
SHA25692930c4685a53954c676b8685214812e5803aae8ba11b4bd4db4165a1bbc1896
SHA51242226ac8ad1d5d3b602f5b401fe97d0bfae744bf75d1c86d8720effd7ee14b76d6cb7d7e10aa84996f89cb0d1f420df9d647429d37277c90fcf88ed28aa4ce00
-
Filesize
9KB
MD5385b027c79eb2d2f1bd5be36fa5e569c
SHA18a9bc96a85034a0d2b84d6cc6d8582f9f480b1c3
SHA2566347082d8379e8844e8f28fc2a2949e08d5aec7f2655dc5db3d418885af1ae30
SHA512b0818869387a94f7499c5ce7442e25d699926d0e89523f58853491b835d15263dc3e7a4930b2b996fb2de49213df6d312cf1ed39a38b0a535a56cf57bf5f5103
-
Filesize
10KB
MD5ae9495fa84e6a2bad278c7edbc9022f4
SHA1a2f50995fe11a52d866c14960d20f2d50ebb8de1
SHA256d702a46dad34c174b9bbedca819922408845412e18fe29899c45ba80c702ce43
SHA51245d2acfdb467c2af9da8489eb9bff61d501f914dc12f9e2b403a34b5fef2128c789f7e9842645f436dfac363a449dbc64f81c7a7d70a139eefc397cca17fb31b
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
Filesize
37KB
MD5ed6769a4df30841082d6aece644c209e
SHA1c96fe773d67ecf37794b7178ae61c603e439051a
SHA256a6c963fcb97d5acf3a5b39d64f9039041b3dd1fa8e39bf668ec10756adfd1ff6
SHA512f03c006bbe2376679b340eb0000820de9d8b912171fd9405c41ae53c23ef34aa4ac3982ec29209e4ec7fee362987735a6832f27fdffec028e0d56655c7cd740b
-
Filesize
48KB
MD56eb9b3d0ee6cf49541519d8e624e7f33
SHA14172fd1b3bdf2e306603195edffb0c3268328cab
SHA2566efca677827a739a2f7d76f3176656cd197c85ca509a30c25a112b7c5cf71239
SHA5121f0a066df4943dd0306293a95baaff4d476ccf56babc42f5a23844aaf6a328dc94776a8e2bf90d703e2c09f6c73b469867d15b8d60ba61cd48b5006698d7a57c
-
Filesize
71KB
MD5886da52cb1d06bd17acbd5c29355a3f5
SHA145dee87aefb1300ec51f612c3b2a204874be6f28
SHA256770d04ebe9f4d8271659ba9bf186b8ae422fdd76f7293dbc84be78d9d6dd92cc
SHA512d6c7a90b8fa017f72f499943d73e4015f2eec0e46188c27848892a99be35e0ecbda1f692630863b89109b04636e813ddad2051f323a24b4d373192a6b67cf978
-
Filesize
59KB
MD51fad10f5dc9bd65753031b0942d5497d
SHA1e9d480def6f3bd99d41f40516133bd8bb61803aa
SHA256dc4659a5662e8bc0b832154f1a6511b864b1f2c96bba3379147a0d044f3c9962
SHA512048cacdbe6eaea5df6393e1753f183e52853ae97d2e1a60c3f8cb897072ce13214a6c556a5ce75a0818c0b85fc74c9d0f6631e8521140b5573e768bf627672ff
-
Filesize
105KB
MD5dc7e41920f048bdae9b710a937dcec92
SHA14c34f1c1e94b095a99e68d14f690fa4c0ac3c98f
SHA256a8f9909a105099f3b963aa7842057e302e82116ff54cb8f585ede2a713ee0bcb
SHA512c9a04cb74fd9c4b8c028136737cfbb4902ca09f5c94fd7a057be8600db2d982b83c7882adfef273b46990db8251acbd4e5d352099ff6f146516d56b4eda2e6f6
-
Filesize
35KB
MD577c7f56d1e33777b53b4ff87f99acff7
SHA16cab06635ab1ced0040f60d07a7d6316118f902f
SHA256424a0bde3b25cee6e7ee1fedbcb29885d5d1d9f2115e18081c391e2b16d173c7
SHA512b23f1c55a3b44e199973231c449b1b064317db1068fb0f3c688250666529cb5c11c1812c292d44f01c7bf5006336996a533fb792079ce4968ac16dc6f6de1619
-
Filesize
86KB
MD56df48be376eb5fd94b2e2713a8b0125c
SHA18382f1cdeb9f5fd9bbed0a053d6131a283e9b3b7
SHA25633961f5170937bedf1e01cfc26760110e2c41bd484c16de5d02e060677bf8ad4
SHA512eabc225c507ac6185e976d914e749bbf98a630ca67f3b64b65007805fc0701839c87653e61ffe2ca5dad2d5777ffb308f744ed62a99b7484d608ed157cca818a
-
Filesize
27KB
MD5e8629692676d9e2583c6dbdc52c6e96e
SHA19ef1d81a444e8e774bf6de35b304c9f8e9a78f3c
SHA256e9292e11b9bac88795b6426182b49f059ac6dc58e8f6f401a72fbb91ce3e9bbe
SHA512765acddfb26e236bd7609835e3a8fb3cd7acf3ea9edd54f794a86618bdefa7e7955351f7f3c3b4dff6382f1c6fba1cad8579ed8eb8e6a1af54dbf4be8b237763
-
Filesize
33KB
MD5d30cecf3b67d5bdd5f7bf27754309821
SHA13cdd7dd092fce6987f8702cc6439f33d5a8c06ea
SHA256540995fc40202552b3b774b1d5033eac953e142ff12808c019d74d7b1ae95fb9
SHA51270275a8493c3025e109554fe83920603b90ac06bc55580a6340fa0912be658a9cb9266b98c4026bdbbd5309b85a499c9dfb2989882afdde6d28acd0ba9d2ffdd
-
Filesize
26KB
MD53353cbb44ecee097062ecbdaa56af118
SHA10dcc9bc123dd31d209dd93f34c52f18aefaecfbd
SHA256a162bb0be5d979bd9c7b426892a9219dd79f876a2946304ccdacb3aa1120472e
SHA5121d7260b2226fbb90a354689054625241863c7cfd605237f7f61ac2e13f0e75d5cad7abb702ffb4cfa32ce3820c07339cf113df4d7406c1133f455dce504661d6
-
Filesize
44KB
MD5f9ee6bd75f3b51aee3d3b125eb348ea3
SHA1b0768266b6cf9e6ff27edadd5f809542aef22174
SHA256562c7379da9c5963c9bfcb027450b9143e7fb5644a06607a8cbfb07898bf161a
SHA512c631d245dfec8eeb087a2803f0f1f422b522c6bda809cda3277ccd8fdd1cbba0010bdd3c2af4bb7d9ec8eebc183bb2c031a7c8241ca4243e91e2b6254f256b7a
-
Filesize
57KB
MD5fbf309bd368f223f4c2a6d8d5315a2fd
SHA1b40959cd717993ae6109ce59505443ce50eec344
SHA2565f1c82c2826f6affb1f9f8fc0ad296cbfd3e7ef608718500784c43562e271b59
SHA512b12040c141ae06fafa5f42b6f2fdf88bcc492d274c02c9ac518db65302d106a633e35eca7bc663abcbc224025a7f46f819dd12bd43427bd458256f336a2077d5
-
Filesize
65KB
MD5f039b697f13a96dc6408b03f21ec85e5
SHA15db227f61a558bc6e60248af88e0df495fc89a08
SHA25654b4ab6d2f1d7bb49334ea109b88c5f49abc4df398af37ee6b83e680fef760c1
SHA51237c127893ee410ee8ad8c2a47b4f9a1440009b4b1800e3638e5df813c3edcf7a4c93cac0aaf31e2edcd3b9af01b1ea4f7902d754261a9a4a458d4adad480c0e4
-
Filesize
24KB
MD5b9e2ab3d934221a25f2ad0a8c2247f94
SHA1af792b19b81c1d90d570bdfedbd5789bdf8b9e0c
SHA256d462f34aca50d1f37b9ea03036c881ee4452e1fd37e1b303cd6daaecc53e260e
SHA5129a278bfe339f3cfbd02a1bb177c3bc7a7ce36eb5b4fadaaee590834ad4d29cbe91c8c4c843263d91296500c5536df6ac98c96f59f31676cecdccf93237942a72
-
Filesize
28KB
MD5b495c3ede38a7d26b66e1614dac26fa6
SHA1c82ed0b8b80d93c902d0be11dfaa3c0722f6f206
SHA2561f2ad100bb0b949ea7ab9f298835ef2d1688314d7a490489ae80e2a9eb8e02b0
SHA5121e333722289d94a7517c97521f7d849a3bbf97064ddd0a7475b6a03872ef945c432f6d92d466b7b8a438792827c73e8d06d3a4a6f34bd1b9f60ce95efa10725a
-
Filesize
1.3MB
MD5ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA256eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
SHA5124f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
-
Filesize
9KB
MD521898e2e770cb9b71dc5973dd0d0ede0
SHA199de75d743f6e658a1bec52419230690b3e84677
SHA256edd490bec8ec903cdbf62f39e0675181e50b7f1df4dc48a3e650e18d19804138
SHA512dc8636d817ae1199200c24ac22def5d12642db951b87f4826015fd1d5c428d45410ce3b7f5bb5aaaa05deecf91d954b948f537bd6fa52a53364ab3609caac81d
-
Filesize
39KB
MD54e5cd67d83f5226410ef9f5bc6fddab9
SHA1dd75f79986808ff22f1049680f848a547ba7ab84
SHA25680645609f9a48a8aaf988fa667f5aa32445e32f8027f61b27884d738ad608ae4
SHA512e52eb7b51562a336c73c6b5b8a1ae821a7c2ad0145633858fc78d6af1a27d8f57ba59cfffa84a376f59d5362a19a7cc09fa1f691c7b50b3ac27c439781a42ba0
-
Filesize
1.6MB
MD533f448cbb24a96e2a13cf3cf4c280904
SHA195fa1c731c18d8094d861c5958018c4d74fbef18
SHA256b1a3a3d090fcc0263bdc508efe7b818cecd34ea43c38e90e42cd9f40e36b7243
SHA512a7c84464e1a26df4fe2c88f006b1d0523d894c04831347cc4005778cade15521d13bd40a5b269698b5b76d5514f5d21dbefad954c69f055a1940aaf4d1f29035
-
Filesize
29KB
MD5bb1feaa818eba7757ada3d06f5c57557
SHA1f2de5f06dc6884166de165d34ef2b029bb0acf8b
SHA256a7ac89b42d203ad40bad636ad610cf9f6da02128e5a20b8b4420530a35a4fb29
SHA51295dd1f0c482b0b0190e561bc08fe58db39fd8bb879a2dec0cabd40d78773161eb76441a9b1230399e3add602685d0617c092fff8bf0ab6903b537a9382782a97
-
Filesize
223KB
MD5be89dde1ed204a5e32cd9f0b2cd8cb0f
SHA1053fd1853482b2f7c7c62bd947852992e84bb899
SHA2568f559bd71d0d422a2d44ffb9f489bd0a9764b31b6c8e265809d9f483fe75399d
SHA5127dbdc1417661845b85582f0b63c6f0d84e66e5d29aad404b9c87270f6552f7babc9736340effebdee7573816e735b306c430f2ea122c06ed806de1669d2b3b30
-
Filesize
31KB
MD564c303e4788d23039d4981849d655b2e
SHA1311f70607eb3ccf85f4c2c7e04d8188b9280fef6
SHA25661e07823df608062f8223942eecb8415eaa1ad15e2783c95657cf749840d8ce9
SHA512094db4655e5c7873011f7c37be1a6bb414bef48df39d846d15b6f2811ac8a9fd91d678153c3652099343d4d2832cb459a2bc4596160df9b15d62521fa52755bc
-
Filesize
87KB
MD55f69b9b6b0fd3841894a15b15607c6ed
SHA167956a5b991f54bd5db2e23d62cb108ac4f42886
SHA256ba2bf2d291d3d7d348cd888193e1366440ef332d16b205dfe328d99acd01f53f
SHA512a0bc06be62cb056c5cf7c55e2110a74809e73b9266e7986efca29be487d5d1ececc52e44696e76944370fe6cecc7f0582702be3803a28d1772aecf0b7052fbd3
-
Filesize
66KB
MD54038af0427bce296ca8f3e98591e0723
SHA1b2975225721959d87996454d049e6d878994cbf2
SHA256a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
SHA512db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3
-
Filesize
405KB
MD5af993787cf1dab3bf73518a16c02637e
SHA174a22de187fe9aa0e8b3e98db2891160613dfe2e
SHA256830d85d62dc13c07e1da67dd9229e00874a973aa3e11657fcba94348c10394bc
SHA51242df137ccd3ace7a9d53c6750905dcfc2c12bbbad2ac7dedfabeeb6b6ac4591a72c66a44d7959f0883e7f349988a6c72ecf77efbf38aba223f8fae891c1f4300
-
Filesize
1.8MB
MD5667e7967137e42e693059a6b9ffbb65c
SHA13d8a134f4ef422f922b4fdc7bc126bba5eb9b12e
SHA2564091f7c2d23be37bea7250a369611140644a7f5a71d095cc0d6b2f0bfe37530f
SHA5127fa1161dee9f59f11e30d711ab40eb9f743ef243ef7b718863cb5d099bb5a8d523dcee67bbf3125cc893a9bfe21811335ee09bbc0a5cb1a13d979a6936cac3ac
-
Filesize
25KB
MD5210c99a3298e6bbeb91f59028fe725c5
SHA1a371165ce7da0573e60872e083f35f5c5f3d5bf4
SHA2560343b0d11146020603e33b392d3752b8e1d2dacb6e9121fe9e9ab872998b0de7
SHA512e6fe38f40b705f865aae10ffd354fe5606ab9b614805de4d1e2036967077e2c20aded6d9f782ce7734576575b926b2d8ce7a0dd1ffc0d65a049e31dd22463349
-
Filesize
630KB
MD5f453ee42d1a4dcc15f977ab976f459f4
SHA12e71bef920daaa1fd46b0d121fdce4ef4e765795
SHA256712ea5906fa60b60defe0d6be1cabee673c10fe545eb27b5ff87498788c92c41
SHA512467957abec90d68dacc07a77f4e2a8b196b2d08d1f577cca9744ee07606454309aadda7145291a531c95dfd71f3321e408c10032bdc366975f033b8051981b3f
-
Filesize
295KB
MD59449204a107e132caf60fe4a14c3026e
SHA1c9701b8e0c086035a59287961b26589930b3bfc3
SHA25615ce14be8970b3ddfed932720221d67a66ebacc74682564033b4b60db57651a3
SHA5128cfddc8a5a02e1405e8c89add9f3a81d6db0c402f18e39d9104f715455ee7af02924378aae9e93a399340385407f97048345fed92856b545a157b274a3a3529a
-
Filesize
5.1MB
-
Filesize
184KB
-
Filesize
6.8MB
-
Filesize
820KB
-
Filesize
148KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
144KB
-
Filesize
52KB
-
Filesize
1.5MB
-
Filesize
52KB
-
Filesize
96KB
-
Filesize
80KB
-
Filesize
52KB
-
Filesize
44KB
-
Filesize
100KB
-
Filesize
204KB
-
Filesize
820KB
-
Filesize
156KB
-
Filesize
212KB
-
Filesize
52KB
-
Filesize
180KB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
5.1MB
-
Filesize
60KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
52KB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
72KB
-
Filesize
44KB
-
Filesize
2.5MB
-
Filesize
204KB
-
Filesize
164KB
-
Filesize
148KB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
148KB
-
Filesize
820KB
-
Filesize
204KB
-
Filesize
5.1MB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
96KB
-
Filesize
156KB
-
Filesize
6.8MB
-
Filesize
148KB
-
Filesize
100KB
-
Filesize
60KB
-
Filesize
180KB
-
Filesize
52KB
-
Filesize
212KB
-
Filesize
52KB
-
Filesize
100KB
-
Filesize
52KB
-
Filesize
820KB
-
Filesize
204KB
-
Filesize
5.1MB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
156KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
2.5MB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
164KB
-
Filesize
48KB
-
Filesize
184KB
-
Filesize
44KB