kinsing | 0f815e77890f9d841a741f82a929043b8768612062720716ce39f7f8734390f0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fkanf.exe
Size 5.5MB
Sample240125-s6rhjsahbr
SHA256 3c48f0b3a2141508c56487b84d290c76761ae1fd971ece56e3b4e5e30d44f08e
MD5 c10abbc5bc3c443aac4a0d02b9ccc650
SHA1 9bc795cc20f054b691b9ccfa055f4481a930584f
SHA512 91406ea440e0b8bdc27b50c45a445a469073303576cd47ca78a3c08654146338b01433b6672a8ba5b3adcf40413de25344e59698758a4b00a41b3ae06fd84c01
SSDEEP 98304:zaDFBICyU+Jq7yaH93b2ini9wthtbFE6dsmaXZBb6T2fuDw:zkFh+IBHV3thVFE8sm8ZY2fA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader vmprotect

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	laticoe.exe

Executes dropped EXE 2 IoCs

pid	Process
888	laticoe.exe
3188	Yloux.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/3876-3-0x0000000000400000-0x0000000000DBE000-memory.dmp	vmprotect
behavioral2/memory/3876-1-0x0000000000400000-0x0000000000DBE000-memory.dmp	vmprotect
behavioral2/memory/3876-15-0x0000000000400000-0x0000000000DBE000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Yloux.exe
File opened (read-only)	\??\I:	Yloux.exe
File opened (read-only)	\??\P:	Yloux.exe
File opened (read-only)	\??\Q:	Yloux.exe
File opened (read-only)	\??\S:	Yloux.exe
File opened (read-only)	\??\U:	Yloux.exe
File opened (read-only)	\??\Z:	Yloux.exe
File opened (read-only)	\??\O:	Yloux.exe
File opened (read-only)	\??\R:	Yloux.exe
File opened (read-only)	\??\W:	Yloux.exe
File opened (read-only)	\??\X:	Yloux.exe
File opened (read-only)	\??\Y:	Yloux.exe
File opened (read-only)	\??\E:	Yloux.exe
File opened (read-only)	\??\J:	Yloux.exe
File opened (read-only)	\??\K:	Yloux.exe
File opened (read-only)	\??\T:	Yloux.exe
File opened (read-only)	\??\V:	Yloux.exe
File opened (read-only)	\??\B:	Yloux.exe
File opened (read-only)	\??\H:	Yloux.exe
File opened (read-only)	\??\L:	Yloux.exe
File opened (read-only)	\??\M:	Yloux.exe
File opened (read-only)	\??\N:	Yloux.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\Runn\WindowsTask.exe	laticoe.exe
File created	C:\windows\Runn\DuiLib_u.dll	laticoe.exe
File created	C:\windows\Runn\sqlite3.dll	laticoe.exe
File created	C:\windows\Runn\Yloux.exe	laticoe.exe
File created	C:\windows\Runn\1.bin	laticoe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "179"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "959"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "38"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "83"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "86"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "193"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "959"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "1097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "74"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "86"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "179"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B08E6A3D-BB98-11EE-BD28-4ECC77D3B663} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "11"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "83"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de600000000020000000000106600000001000020000000d2cae75739db73d5f2315fd1e2b4a07b6111445007989f3d3d8689705036ff86000000000e8000000002000020000000a6e447352cdbf1956541e77895eea9f7de4daeaec278d28ea7e8a682405bce272000000042eb7e31bad44b76cf68bb969ca674c93a650b32341329b8c65a4513afa8844d4000000018d07454dfc837d1ed978409b21d2ba28afddef089f0401eee053cdf3c230bf62535fe66bb917cb9051a0d0ea0c791be98514585fb6dec3d3db2e621ce87b440	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "83"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "136"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "193"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "959"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\ = "74"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DOMStorage\sms-activate.org	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "51"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2232760822"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2230910538"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084453"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d69d86a54fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sms-activate.org\Total = "164"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de600000000020000000000106600000001000020000000c00ca05a8cd1e23ac726190ab47b6afbb69eb8d449c2c716b69f32db8f546020000000000e80000000020000200000008a4f1a7a652b5e7e9cbed8eec27e691402c24935c4655a3df6f3e991b16f3193200000008f8bc6a3c8fe60eb109609f989da321c87eaf9b7c474ba116a6efd040f39b04a4000000019e97eec9e42d8803c76e48dd47776153c4a7ba5e5d6b8a0965700d8f4867ad69a405f7b0f189ba90d6054759c7956a1f7ea6d3256a9417868c1806a9a9dee82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "74"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "136"	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{D9A9E009-AC35-4EDB-8CB1-259A29331D0F}	IEXPLORE.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2352	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3876	fkanf.exe
3876	fkanf.exe
3876	fkanf.exe
3876	fkanf.exe
888	laticoe.exe
888	laticoe.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe
3188	Yloux.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2988	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2988	IEXPLORE.EXE
Token: SeShutdownPrivilege	2988	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2988	IEXPLORE.EXE
Token: 33	848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	848	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4892	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3876	fkanf.exe
3876	fkanf.exe
4892	iexplore.exe
4892	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
3188	Yloux.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 888	3876	fkanf.exe	31
PID 3876 wrote to memory of 888	3876	fkanf.exe	31
PID 3876 wrote to memory of 888	3876	fkanf.exe	31
PID 3876 wrote to memory of 4892	3876	fkanf.exe	67
PID 3876 wrote to memory of 4892	3876	fkanf.exe	67
PID 4892 wrote to memory of 2988	4892	iexplore.exe	72
PID 4892 wrote to memory of 2988	4892	iexplore.exe	72
PID 4892 wrote to memory of 2988	4892	iexplore.exe	72
PID 3876 wrote to memory of 1420	3876	fkanf.exe	70
PID 3876 wrote to memory of 1420	3876	fkanf.exe	70
PID 3876 wrote to memory of 1420	3876	fkanf.exe	70
PID 1420 wrote to memory of 2352	1420	cmd.exe	73
PID 1420 wrote to memory of 2352	1420	cmd.exe	73
PID 1420 wrote to memory of 2352	1420	cmd.exe	73
PID 888 wrote to memory of 3188	888	laticoe.exe	103
PID 888 wrote to memory of 3188	888	laticoe.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fkanf.exe
"C:\Users\Admin\AppData\Local\Temp\fkanf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876
- C:\liostpy\laticoe.exe
  C:\liostpy\laticoe.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\windows\Runn\Yloux.exe
    "C:\windows\Runn\Yloux.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3188
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://sms-activate.ru/cn/getNumber
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4892 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 &del "C:\Users\Admin\AppData\Local\Temp\fkanf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:2352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x538 0x52c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 845c8a47772a9c534cf13a177c83c40db250a6dbbd0a369401ea884b8d058d6e
MD5 1d7f25dc2d6699e79619c31ff8908f6c
SHA1 de3c1be6c3f3e7f6eadbe715ae575794e5bf1221
SHA512 7a6e1765a31821e79b766ea0675ed17d735a40766d5fcd6cc305a8d33b8257d11e492d4ad8626f2909e1c2c2d93e8d04ed133effd0a3ec29324ec3ca36a22a1e
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 caddca6ca6e76165327b2c1256098c0405de38eb571e55990ed70a0b471e9972
MD5 6aec25f64e8edd8d06d4b7ae687ca02d
SHA1 f77e1fec6a8e45e14fe354c6bcee55df249b9e96
SHA512 fe7cdafa3c04fe96a88516c6bba9ec17674f73c280614b1de870133e728df6328f1506ff3c3b0c72e3b8eca2992d0695ee6a89ae33f81e10e25117917a4c5f04
MD5 SHA1 SHA512

Submit Download

sms-activate[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\39DY02XT\sms-activate[1].xml
Size 270B
SHA256 a2463344139fc2e9f89c57e214df688df015f5ff2293b663bea75cb0d2e7254e
MD5 2c21215afb00c04b8cca1cd611fbb179
SHA1 42b5b55aba5fb29a63791fff2c4df3386b296a20
SHA512 8d51f135c105ea9a942e911cb49eb8cac78f99712309c3c53bc057fa87e22b15cfb9d5d9ca36948ad62dd29f513e61cca7b3c46fdadbd341601514d9d95f210d
MD5 SHA1 SHA512

Submit Download

sms-activate[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\39DY02XT\sms-activate[1].xml
Size 835B
SHA256 5c02bfdba48c2a255ab7847a7766d205fd1d2d88987f3bfc98af038b5de3cf5a
MD5 563eed195451080277ff93215c9e980d
SHA1 7d8005f5d9cc6630dabb5e7b1ae21abb6b06ac5e
SHA512 8a0b13928255a4a7d1ea23fae43ac96cab886f883b5a4f1cc76b07dee761fb16097d673451b8463c908a3883b034a964152c31dfc0269c1fddc74772434dbc9a
MD5 SHA1 SHA512

Submit Download

sms-activate[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\39DY02XT\sms-activate[1].xml
Size 690B
SHA256 d77fe96df3ba7019f75e24223a05afa3693447e505dc892ddb65be2219d5ee5a
MD5 e8d8c2775d133cb51ddd1c520de3f40b
SHA1 c37dc5a3d09a0b23c06d5da343fe380149c05146
SHA512 e3b79e2ef4e243a0cb12a2e5eb700861ba77dfe9bbf68dc8b76f502507bd142a29c9db5a06198f65232c9e9b8caba2161f634a2556a315ba4b07e0378bd20a80
MD5 SHA1 SHA512

Submit Download

sms-activate[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\39DY02XT\sms-activate[1].xml
Size 2KB
SHA256 628745b9d172ef790795a70a9c04ad0ea43826f643a71208a0bd74626d18991d
MD5 52343da34de4eefce19eae7223b787ce
SHA1 34e58541405676cc1086fd7ff136c99484ebec43
SHA512 c448d67d355412bbf2fd4775864c2f60c6f661236f69edd6443b8607f6c1fd353f9997ed74c85c1a9a689179d8077f28b21c9cc3fdb9791a03d0bed7f9451f60
MD5 SHA1 SHA512

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9owjsyb\imagestore.dat
Size 832B
SHA256 fbd50b772771bd7acd8b4e6bfad465f0d31e1ce25e12aa159f18924787b62858
MD5 db9fe3e24c0a28a557b30b0c2dd2de91
SHA1 b6a6ff049e0d7e912cabf0cd9c35421cc9b35d5b
SHA512 b0c59e5fe76e0498fc7e95923c5685404b98caf80e515b5ec83d1491e9b0e539b62367741a61f429471c448269797e85aff326a84b410fb3e4154d0e20133656
MD5 SHA1 SHA512

Submit Download

activate_favicon[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\activate_favicon[1].png
Size 624B
SHA256 29c11b104967a9b054c179230a8faa99033044ff106a0b49acbbc604e53a4e3d
MD5 49fd14489af959c08d1f0cc073788fd6
SHA1 f5a22605926a80dab3114f170e069a3d97a72ff3
SHA512 a313b8a913caa79d30002eddc491cf66297d7011ac6f3376129cb97bd581fc832848eab2fd336a37949f5813732fdb229935a3907875ac077e39b86162f0f831
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

analytics[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\analytics[1].js
Size 51KB
SHA256 de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
MD5 575b5480531da4d14e7453e2016fe0bc
SHA1 e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA512 174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a
SSDEEP 768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yloux.exe

Path C:\Windows\Runn\Yloux.exe
Size 2.7MB
SHA256 a26cb4dc40c333bb37cc2bf5e67fb90529a065b77dc30d0756714e20f3e48a2a
MD5 0e5ec1183c45ef124a8c031eca0dc7a3
SHA1 6bb07b3d95e97aab4d47d2e00f1d00b1285831ed
SHA512 9eb19367a8d1d4829b278a2e86973faee3e5bbb1dfb68ac0ff8cb1cf542f14c2054efd82d6ab0d6fc8cefa7ed7dd42a265c1b37238e8379c568ba59f530227e4
SSDEEP 49152:L3g0Q0d3zk0i+vo0K4/1oWNyGDFkuWvtIvh5pP:LO0i+vo0K4/1oWNyGDFkuwMP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yloux.exe

Path C:\Windows\Runn\Yloux.exe
Size 3.0MB
SHA256 875e0934d086e6bb3cc03d65d3ef60a7b2f69b966e64de015541db5748d376db
MD5 9289c4d7ce63082a6b104b49382273c9
SHA1 541187577d7fdea110b8868f2f059d4c2c34b9fc
SHA512 c3807c8a4e1d5aef81b19eb3df5ce54494264d75c191c6b4387902b133a2b934864706f59e927e9b1bb96712270863ca02137b49f695b10281f227fe6710628e
SSDEEP 98304:LO0i+vo0K4/1oWNyGDFkuwMVT7NxAYMlzc:LF
MD5 SHA1 SHA512 SSDEEP

Submit Download

laticoe.exe

Path C:\liostpy\laticoe.exe
Size 162KB
SHA256 03e2c597d6902e80235b7b43523f49e7267b785ff9b16a665f2aeca8413c5cdf
MD5 137c982a502951b4e8b83c3a8b312297
SHA1 5ab1f07e3073492593932bcab7e65dd0224b2134
SHA512 c46b8afc4d4e475986c82ed42fd856b07bd365c48d915a76079c81a5ab2adc7d9c446cd851620327452ba256e26289dd56838d7570854b69aac8a91b7eaf5d89
SSDEEP 3072:S6p2Jb0cvThtwBPGCXnWXjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqAT:SE2lJv1t6
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.bin

Path C:\windows\Runn\1.bin
Size 176KB
SHA256 702eb45ead6494f36944f5d16e5aef30de138c6d16fdf92eedd098fb59fa5347
MD5 3d7d682f44b0b12b5518d3e9c6c11d2a
SHA1 23869cb52e797c0f5c64364af8c78c49c71b9c27
SHA512 6295f519308b8ccd4ce6cea1058340dc25fdba5414a44c8c952437dc2cdea42b783e476ded8c855d0423895c1e8d0667eda817d956322d78ceeb5e10139af550
SSDEEP 3072:GPsOwepVlSSAeoj9qpGtGHJTstln4IbZTvfbmrTsmzT3c22NXawzoHQk+:gsbeo9qpGtOTstN4IbdvfbA4m3pwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/888-350-0x0000000010000000-0x0000000010604000-memory.dmp

Download

memory/888-349-0x0000000002480000-0x0000000002A80000-memory.dmp

Download

memory/3188-367-0x00000000001D0000-0x00000000001FD000-memory.dmp

Download

memory/3188-395-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-445-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-443-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-434-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-432-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-431-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-368-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-374-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-375-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-376-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-430-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-392-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-393-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/3188-394-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-414-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-396-0x0000000000CC0000-0x0000000000CFE000-memory.dmp

Download

memory/3188-397-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-398-0x0000000000D00000-0x0000000000D44000-memory.dmp

Download

memory/3188-400-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3876-6-0x0000000002B80000-0x0000000002B81000-memory.dmp

Download

memory/3876-7-0x0000000002B90000-0x0000000002B91000-memory.dmp

Download

memory/3876-15-0x0000000000400000-0x0000000000DBE000-memory.dmp

Download

memory/3876-8-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Download

memory/3876-5-0x0000000002B70000-0x0000000002B71000-memory.dmp

Download

memory/3876-2-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3876-4-0x0000000002B60000-0x0000000002B61000-memory.dmp

Download

memory/3876-3-0x0000000000400000-0x0000000000DBE000-memory.dmp

Download

memory/3876-1-0x0000000000400000-0x0000000000DBE000-memory.dmp

Download

memory/3876-0-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download