9f05914ea6cced1deeb296846bfdd0319da103339813951609dab21e7ced4904

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KBE2SLK.exe
Size

925KB
MD5

b8df5209815c9c44f9dd31838935c286
SHA1

934328477b27fccb5b86be678d7ae1688c61c835
SHA256

1cfef8d20f582d5eb10b652036293eed24d7672ec4ec89263bab65bd91a4f382
SHA512

9239369837e275923af59e683d07efadb821119aa3038d1d0d263ef6413d2a1ac290d012e679b13cc2484a3a07efcf04f6a4fc497c12e3d756bfeb5b25e51bd1
SSDEEP

12288:kelOqMds1R6CNROVZC7/U0PLyL2wJ/jtKUVnK8dB3KfncHsQjeZpYXkj3FGNij85:kelVT5NArC7/pzyLThfoaoZXF8COViW

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine	KBE2SLK.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1728	KBE2SLK.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1728	KBE2SLK.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	KBE2SLK.exe

C:\Users\Admin\AppData\Local\Temp\KBE2SLK.exe
"C:\Users\Admin\AppData\Local\Temp\KBE2SLK.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-7-0x0000000004240000-0x0000000004241000-memory.dmp

Filesize
4KB

Download
memory/1728-12-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1728-15-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/1728-17-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/1728-16-0x00000000041E0000-0x00000000041E1000-memory.dmp

Filesize
4KB

Download
memory/1728-14-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download
memory/1728-13-0x00000000042A0000-0x00000000042A1000-memory.dmp

Filesize
4KB

Download
memory/1728-11-0x00000000041B0000-0x00000000041B1000-memory.dmp

Filesize
4KB

Download
memory/1728-10-0x0000000004200000-0x0000000004201000-memory.dmp

Filesize
4KB

Download
memory/1728-9-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/1728-8-0x00000000041A0000-0x00000000041A1000-memory.dmp

Filesize
4KB

Download
memory/1728-6-0x00000000041F0000-0x00000000041F1000-memory.dmp

Filesize
4KB

Download
memory/1728-5-0x0000000004110000-0x0000000004111000-memory.dmp

Filesize
4KB

Download
memory/1728-4-0x0000000004120000-0x0000000004122000-memory.dmp

Filesize
8KB

Download
memory/1728-3-0x0000000004100000-0x0000000004101000-memory.dmp

Filesize
4KB

Download
memory/1728-25-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/1728-26-0x0000000004230000-0x0000000004231000-memory.dmp

Filesize
4KB

Download
memory/1728-27-0x0000000004180000-0x0000000004181000-memory.dmp

Filesize
4KB

Download
memory/1728-24-0x0000000004220000-0x0000000004221000-memory.dmp

Filesize
4KB

Download
memory/1728-23-0x0000000004360000-0x0000000004362000-memory.dmp

Filesize
8KB

Download
memory/1728-22-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/1728-21-0x0000000004270000-0x0000000004271000-memory.dmp

Filesize
4KB

Download
memory/1728-20-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/1728-19-0x00000000041C0000-0x00000000041C1000-memory.dmp

Filesize
4KB

Download
memory/1728-18-0x0000000004250000-0x0000000004251000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x0000000004170000-0x0000000004171000-memory.dmp

Filesize
4KB

Download
memory/1728-1-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-28-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-29-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-30-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1728-31-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-32-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-33-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-34-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-35-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-36-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-37-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-38-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-39-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-40-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-41-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-42-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1728-43-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download