Analysis
-
max time kernel
8s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-01-2024 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3485de720983163afe70bd0052dc1d68.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3485de720983163afe70bd0052dc1d68.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3485de720983163afe70bd0052dc1d68.exe
-
Size
72KB
-
MD5
3485de720983163afe70bd0052dc1d68
-
SHA1
dad5a8c76fc9039faeef4158f4fc081081fb33a1
-
SHA256
d478d6dd237e22795b46ed1daa57b1968ec5d449e60e24cfed4e502549eca0b4
-
SHA512
a9e40aca9404789f7b673a33a20b1af8cd4763cbc42ed61f1fbd04b6d2f407219ef3524f63a77dbf17f952d6f0cdfd0c5df56648f9aa05666286335e945b87d9
-
SSDEEP
768:hmmuiuFhFtI0bgiY7qDpGjW7/U/jSXuHQilKPMPC4VqrMZWXArffTeffUW7EBmAQ:hcFmw3kqDUWb0jOYC4VqrMZWXAWAdN4
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kbteog.exe -
Executes dropped EXE 1 IoCs
pid Process 2368 kbteog.exe -
Loads dropped DLL 2 IoCs
pid Process 1428 3485de720983163afe70bd0052dc1d68.exe 1428 3485de720983163afe70bd0052dc1d68.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\kbteog = "C:\\Users\\Admin\\kbteog.exe" kbteog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe 2368 kbteog.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1428 3485de720983163afe70bd0052dc1d68.exe 2368 kbteog.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1428 wrote to memory of 2368 1428 3485de720983163afe70bd0052dc1d68.exe 28 PID 1428 wrote to memory of 2368 1428 3485de720983163afe70bd0052dc1d68.exe 28 PID 1428 wrote to memory of 2368 1428 3485de720983163afe70bd0052dc1d68.exe 28 PID 1428 wrote to memory of 2368 1428 3485de720983163afe70bd0052dc1d68.exe 28 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14 PID 2368 wrote to memory of 1428 2368 kbteog.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\3485de720983163afe70bd0052dc1d68.exe"C:\Users\Admin\AppData\Local\Temp\3485de720983163afe70bd0052dc1d68.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\kbteog.exe"C:\Users\Admin\kbteog.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD58135f931767734ebdf37081bc8748112
SHA156959e45e0588c4ec5ce537e392f2c4732655aa0
SHA25648a3bfade241ffd51410b0767647576120ebaf4094412012d167164100510668
SHA51216b1df3c3e555d15f22936baa91d49bca3cdee84510a77fde1e906d5071bd7a07006caddd71387c5cc8403af8112f145142d07801a8f232f669599240268d82c