Analysis
- max time kernel
37s - max time network
137s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
07/01/2024, 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3b3a6fb394733b810b33e03cbbac1e2.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3b3a6fb394733b810b33e03cbbac1e2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a3b3a6fb394733b810b33e03cbbac1e2.exe
- Size 152KB
- Sample240107-x95a2adef3
- SHA256 4f791b543bd4f0e58fd454a03a8f6c88e5f9528c9f3b77eaafef26b18386234d
- MD5 a3b3a6fb394733b810b33e03cbbac1e2
- SHA1 873cc109d9c2e9de3bb77e256673bfb4625dbaa9
- SHA512 d961edd322059c93dba78b758614d01aa3fa0cc16f5699d3a6de8ed5f58ebaf04fcd1db02c0f5b4f63a9ac467480a68b7aa5c15774c375e7176164c5efdd2f71
- SSDEEP 3072:H3sZvl3Po5+tTjFqV+t3DRGCKBiAKE4oQZiEVx:KQ5+t8+NDR5ApWN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a3b3a6fb394733b810b33e03cbbac1e2.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" knleef.exe - Executes dropped EXE 1 IoCs
pid Process 2468 knleef.exe - Loads dropped DLL 2 IoCs
pid Process 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe - Adds Run key to start application 2 TTPs 32 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /w" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /B" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /s" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /c" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /J" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /P" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /b" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /t" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /f" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /p" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /T" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /C" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /Y" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /V" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /n" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /G" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /u" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /S" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /m" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /D" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /v" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /z" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /R" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /g" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /d" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /W" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /I" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /l" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /Z" a3b3a6fb394733b810b33e03cbbac1e2.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /M" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /L" knleef.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\knleef = "C:\\Users\\Admin\\knleef.exe /x" knleef.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe 2468 knleef.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 2468 knleef.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2468 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 28 PID 2436 wrote to memory of 2468 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 28 PID 2436 wrote to memory of 2468 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 28 PID 2436 wrote to memory of 2468 2436 a3b3a6fb394733b810b33e03cbbac1e2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b3a6fb394733b810b33e03cbbac1e2.exe"C:\Users\Admin\AppData\Local\Temp\a3b3a6fb394733b810b33e03cbbac1e2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\knleef.exe"C:\Users\Admin\knleef.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468
-