Analysis

  • max time kernel
    300s
  • max time network
    379s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:36

General

  • Target

    Kiwi X/Kiwi X Bootstrapper.exe

  • Size

    178KB

  • MD5

    9f07ff71a41d0707a88c679aeead9bc1

  • SHA1

    4c003b20f81fda703383c3751ac2bdeb41a57987

  • SHA256

    4d819c0df101498676f943c688edcd812161be8e82fd2a1877b5690cd3679ca9

  • SHA512

    c1537f0050fd22edcbd5e47bf4c13754a9126ebe897a2be42d45e302e1dbad2da69af0487a3d2eb373184ddb1c682dbef27ddef616faf5f0c19bd566ae767d62

  • SSDEEP

    768:TIEJncjFwUuDtL1uogdqbYBKuv4+CdQpKEBy0lGtCvvApflHp+jEJOxCjZonIrjs:TmMmKzz3GMIh5

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe
      "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1136

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Kiwi_X_WPF\Kiwi_X.exe_Url_r0xbolx2byytzmmw2u1fc3xa1yugsbjn\1.1.0.0\user.config

          Filesize

          310B

          MD5

          fc4bddde3292e03d5586f62d92189b1b

          SHA1

          ceeba68f267f5568b9b0766468724ff8b608d412

          SHA256

          dc981b12d99456f4676ee1352af94da5292cd618b416aeedc8d8ba5a492c3e1b

          SHA512

          94155fbd6e0f54fe282752d5cad19bf09c4835ce96a466a5a38bd7024ed1090d58ee672a0d5f09c918df2ee79c795c59ef79ca182213f78801cfc649760b3c73

        • C:\Users\Admin\AppData\Local\Kiwi_X_WPF\Kiwi_X.exe_Url_r0xbolx2byytzmmw2u1fc3xa1yugsbjn\1.1.0.0\user.config

          Filesize

          416B

          MD5

          d573b0eb98c6d04c74993871673fb128

          SHA1

          d1bef264405318467a8d82e6a9a2de816cf85459

          SHA256

          e38fe2de9ec915b66b5ba2f128fa3eea59d5b273abca60c999381f77d20779ad

          SHA512

          2d384a40a630cbc2d78e6fc1f832438d898f9e81c4650836dad32caadd871aa0d633b47446609610802e1c16925e476a944f5eeedcb8940ed677ce7ad849dcd9

        • C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe

          Filesize

          1.6MB

          MD5

          65d850ea6249b29482fdf6441464c727

          SHA1

          762c553b7f252a279f6a1a64c2375f2430905b34

          SHA256

          a9a9c21344ee06e8386ddf606783dbcf9eff60533135875f38866eb5ae742c0e

          SHA512

          3bbebf28d4ff730011e818af8721e663574d82ccc91b5941844c18806d55540c66b23f9621d20c8ee45db70f56b36faff97e59a928108224c4eedfb8e51898e8

        • C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe

          Filesize

          1.3MB

          MD5

          60da4a8f33288a5993378bb5130f7bfc

          SHA1

          a4b36ffa98f89b8586fbf34312d5b9d60d472911

          SHA256

          1268474ad20cbf8acfa048b9fccac866f1f9ff018f5cfd069049619936c8313f

          SHA512

          1b4a889b60b522f6cc9010c4841383f8c2a8c18d0137c8ac406ac52f2a2b6580c8351a9512c8cd0f748b83b2052a5c73d791e4af9e753eb4a2925079627c6a6c

        • C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe

          Filesize

          1.7MB

          MD5

          806998bb6f4fc3fe3f0beb390799f28b

          SHA1

          445beca37ebd66c54f7eec9c296c6e28b1a9fe89

          SHA256

          33dacaaf579d61d885605998835b3d9355d4d04d6b400ced1895a4583fa48787

          SHA512

          145ff2d9e335a76fb72fe0f56f7e557b96aef4c313ae7858bb7248c1a82a92bab2bc1274750e9964c5a2db62790d7a4562c54118268774e80da8b1082f7c46c7

        • memory/1136-21-0x0000000005C90000-0x0000000005CAA000-memory.dmp

          Filesize

          104KB

        • memory/1136-38-0x0000000006620000-0x0000000006628000-memory.dmp

          Filesize

          32KB

        • memory/1136-17-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/1136-44-0x0000000001AC0000-0x0000000001ACE000-memory.dmp

          Filesize

          56KB

        • memory/1136-18-0x0000000000FC0000-0x0000000001366000-memory.dmp

          Filesize

          3.6MB

        • memory/1136-19-0x0000000005CB0000-0x0000000005CC0000-memory.dmp

          Filesize

          64KB

        • memory/1136-20-0x0000000005B50000-0x0000000005B51000-memory.dmp

          Filesize

          4KB

        • memory/1136-43-0x000000000A270000-0x000000000A2A8000-memory.dmp

          Filesize

          224KB

        • memory/1136-22-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/1136-42-0x0000000001A70000-0x0000000001A78000-memory.dmp

          Filesize

          32KB

        • memory/1136-36-0x00000000066A0000-0x0000000006750000-memory.dmp

          Filesize

          704KB

        • memory/1136-41-0x0000000005CB0000-0x0000000005CC0000-memory.dmp

          Filesize

          64KB

        • memory/1136-37-0x0000000006750000-0x00000000067A4000-memory.dmp

          Filesize

          336KB

        • memory/1136-40-0x0000000005CB0000-0x0000000005CC0000-memory.dmp

          Filesize

          64KB

        • memory/1136-39-0x0000000006920000-0x000000000698A000-memory.dmp

          Filesize

          424KB

        • memory/4620-3-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4620-1-0x0000000000F90000-0x0000000000FC2000-memory.dmp

          Filesize

          200KB

        • memory/4620-2-0x00000000058A0000-0x00000000058B0000-memory.dmp

          Filesize

          64KB

        • memory/4620-0-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4620-16-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB