93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bd2b08ca47144328cbc68041d8714be.exe
Size

2.0MB
MD5

2bd2b08ca47144328cbc68041d8714be
SHA1

6bf34b851bf47514affbb54ea56da74bde446b1e
SHA256

93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c
SHA512

aa7fe3a0a0f1c8ffb8858c0b4304ca0c987b7d3c22a938b2dc1874a1e554892eba51fa9deecd669b82ba776dcb3fc3f29f5d8aa09106dff1a0ca63b962a2c3ca
SSDEEP

49152:WaUQl+AMminT6xkk26lWehIlbJZ7a07xznKMj5RyXE1ID1PX:DLIAMmuu9Ym+xznKMj58aIxPX

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2892	2bd2b08ca47144328cbc68041d8714be.exe
2892	2bd2b08ca47144328cbc68041d8714be.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\KKMAgent = "C:\\Users\\Admin\\AppData\\Roaming\\KkmAgent\\KKMAgent.exe"	2bd2b08ca47144328cbc68041d8714be.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	2bd2b08ca47144328cbc68041d8714be.exe
2892	2bd2b08ca47144328cbc68041d8714be.exe

C:\Users\Admin\AppData\Local\Temp\2bd2b08ca47144328cbc68041d8714be.exe
"C:\Users\Admin\AppData\Local\Temp\2bd2b08ca47144328cbc68041d8714be.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd7BA6.tmp\nsProcess.dll

Filesize
4KB

MD5
faa7f034b38e729a983965c04cc70fc1

SHA1
df8bda55b498976ea47d25d8a77539b049dab55e

SHA256
579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

SHA512
7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

Download Submit
\Users\Admin\AppData\Roaming\KkmAgent\KKMAgent.exe

Filesize
121KB

MD5
2fc184a4b857675e841727609d1e96f2

SHA1
12cf13964ec15ac4c9d7633b3137faf15c5c49d1

SHA256
250ea75bb8040d2b819744eea72305d7fc950ac79e2894f820e6f456d8de5547

SHA512
f06afa3db453e26a2979646f6251ed293f9a1c7a860ef3b0358e6824f666424f573edeb007eaea1f75cfb3318d6fe9344a070910723a1cbdc477d069a4ea6d49

Download Submit