Overview
overview
7Static
static
7KeyMaker.exe
windows7-x64
1KeyMaker.exe
windows10-2004-x64
1everest.exe
windows7-x64
7everest.exe
windows10-2004-x64
7everest.chm
windows7-x64
1everest.chm
windows10-2004-x64
1everest.exe
windows7-x64
7everest.exe
windows10-2004-x64
7everest.url
windows7-x64
6everest.url
windows10-2004-x64
3everest.html
windows7-x64
1everest.html
windows10-2004-x64
1everest_bench.exe
windows7-x64
1everest_bench.exe
windows10-2004-x64
1everest_cpl.dll
windows7-x64
1everest_cpl.dll
windows10-2004-x64
1everest_cpuid.dll
windows7-x64
7everest_cpuid.dll
windows10-2004-x64
7everest_icons.dll
windows7-x64
7everest_icons.dll
windows10-2004-x64
7everest_mondiag.exe
windows7-x64
7everest_mondiag.exe
windows10-2004-x64
7everest_rcc.exe
windows7-x64
7everest_rcc.exe
windows10-2004-x64
7everest_rcs.exe
windows7-x64
7everest_rcs.exe
windows10-2004-x64
7everest_xpicons.dll
windows7-x64
7everest_xpicons.dll
windows10-2004-x64
7everest_zipdll.dll
windows7-x64
7everest_zipdll.dll
windows10-2004-x64
7Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 17:07
Behavioral task
behavioral1
Sample
KeyMaker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
KeyMaker.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
everest.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
everest.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
everest.chm
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
everest.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
everest.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
everest.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
everest.url
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
everest.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
everest.html
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
everest.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
everest_bench.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
everest_bench.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
everest_cpl.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
everest_cpl.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
everest_cpuid.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
everest_cpuid.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
everest_icons.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
everest_icons.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
everest_mondiag.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
everest_mondiag.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
everest_rcc.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
everest_rcc.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
everest_rcs.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
everest_rcs.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
everest_xpicons.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
everest_xpicons.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
everest_zipdll.dll
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
everest_zipdll.dll
Resource
win10v2004-20231215-en
General
-
Target
everest.exe
-
Size
52KB
-
MD5
18413b83982e8c1f9f5f79c344d987d8
-
SHA1
4e08bb1942084011496ff834779a2ffa7596951e
-
SHA256
ef62146cb1d1cf3077b457247621f29767b31c1be88ba8a53cdaf9919190128a
-
SHA512
155737c115acf021f0e6ac917f361dd178abe58de90bb6a240858621c0461c09d521dfbc9cbf471faed35e93840f5d6f4abf64bf4d92bea8ceeec3c77dc61c01
-
SSDEEP
768:iQH/dc2srWMyUX48yBYwAKOl1OAMN25pBI9QM/EiKiywhHclnONlurSL3H/bymD:9H/+HlfwALS0puQMs7iywl6nONlNfxD
Malware Config
Signatures
-
resource yara_rule behavioral8/memory/492-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral8/memory/492-1-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral8/memory/4896-2-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral8/memory/4896-4-0x0000000006C50000-0x0000000006CBF000-memory.dmp upx behavioral8/memory/4896-5-0x0000000006CC0000-0x0000000006D2A000-memory.dmp upx behavioral8/memory/4896-17-0x0000000000400000-0x0000000000AE6000-memory.dmp upx -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\INF\c_volume.PNF everest.bin File created C:\Windows\INF\c_monitor.PNF everest.bin File created C:\Windows\INF\c_diskdrive.PNF everest.bin File created C:\Windows\INF\c_media.PNF everest.bin File created C:\Windows\INF\c_display.PNF everest.bin File created C:\Windows\INF\c_processor.PNF everest.bin -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName everest.bin Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Driver everest.bin Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 everest.bin Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc everest.bin Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName everest.bin Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver everest.bin Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 everest.bin Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc everest.bin -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4896 everest.bin -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4896 everest.bin -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 492 wrote to memory of 4896 492 everest.exe 88 PID 492 wrote to memory of 4896 492 everest.exe 88 PID 492 wrote to memory of 4896 492 everest.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\everest.exe"C:\Users\Admin\AppData\Local\Temp\everest.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\everest.bin"C:\Users\Admin\AppData\Local\Temp\everest.exe"2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4896
-