Analysis
-
max time kernel
79s -
max time network
85s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
koid.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
koid.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
koid.exe
-
Size
1.7MB
-
MD5
937bd53a5f505b8e9b00416590ad8d92
-
SHA1
5abece11f9d282ec009bf441f132676344f1ede2
-
SHA256
662d56478c8fa24fb43b71cba64af8d941ddb90659c2412144b46137e2cc4c36
-
SHA512
2027fe14eff8cc0edd67be7f159e0710d79376aef11a70d4c0ad94d501667fd178780fb3a8f0c4481d2da32a3f6fd698e45cef297aee628cda1ae164e0434dd5
-
SSDEEP
49152:MXi87ZaoNcK9mVrSPYO1M+BrgdhwmzJnU:yvycBr
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
taskmgr.exepid process 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1108 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1108 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
Processes:
taskmgr.exepid process 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe -
Suspicious use of SendNotifyMessage 61 IoCs
Processes:
taskmgr.exepid process 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\koid.exe"C:\Users\Admin\AppData\Local\Temp\koid.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.DefaultPrograms1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵