0c743cd6bd26bc4b3386cbbfd9dffef730354f6e9b17fe2e5783f6faa2eb27af

General

Target

74f41ef79426aa52f86d56ccf4cc21a8.exe
Size

124KB
MD5

74f41ef79426aa52f86d56ccf4cc21a8
SHA1

b1569c80227c783c8a43c96fa8c2fd479382148d
SHA256

0c743cd6bd26bc4b3386cbbfd9dffef730354f6e9b17fe2e5783f6faa2eb27af
SHA512

dba6c8bebb1f50154947909735be99306c73c11341580748dcc0105814ecc986abfad7d988153d27457f5aa04173b78deb04bc53ebe4b1e497402266e98e29b9
SSDEEP

1536:vWtkjiTQbuvU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VewNeG0h/l:skjBbAU0GgAT98t

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

74f41ef79426aa52f86d56ccf4cc21a8.exenkdac.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	74f41ef79426aa52f86d56ccf4cc21a8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nkdac.exe

Executes dropped EXE 1 IoCs

Processes:

nkdac.exe

pid process

2060 nkdac.exe
Loads dropped DLL 2 IoCs

Processes:

74f41ef79426aa52f86d56ccf4cc21a8.exe

pid process

1820 74f41ef79426aa52f86d56ccf4cc21a8.exe
1820 74f41ef79426aa52f86d56ccf4cc21a8.exe

pid	process
2060	nkdac.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nkdac.exe74f41ef79426aa52f86d56ccf4cc21a8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /V"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /o"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /c"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /P"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /J"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /C"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /k"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /K"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /s"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /t"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /N"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /Y"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /n"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /b"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /G"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /L"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /O"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /g"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /q"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /a"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /x"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /U"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /v"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /z"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /r"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /X"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /j"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /I"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /E"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /y"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /m"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /W"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /A"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /w"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /l"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /S"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /D"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /u"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /i"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /v"	74f41ef79426aa52f86d56ccf4cc21a8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /p"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /e"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /R"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /f"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /T"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /H"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /B"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /h"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /Q"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /d"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /Z"	nkdac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\nkdac = "C:\\Users\\Admin\\nkdac.exe /F"	nkdac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

74f41ef79426aa52f86d56ccf4cc21a8.exenkdac.exe

pid	process
1820	74f41ef79426aa52f86d56ccf4cc21a8.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe
2060	nkdac.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

74f41ef79426aa52f86d56ccf4cc21a8.exenkdac.exe

pid process

1820 74f41ef79426aa52f86d56ccf4cc21a8.exe
2060 nkdac.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74f41ef79426aa52f86d56ccf4cc21a8.exe

description	pid	process	target process
PID 1820 wrote to memory of 2060	1820	74f41ef79426aa52f86d56ccf4cc21a8.exe	nkdac.exe
PID 1820 wrote to memory of 2060	1820	74f41ef79426aa52f86d56ccf4cc21a8.exe	nkdac.exe
PID 1820 wrote to memory of 2060	1820	74f41ef79426aa52f86d56ccf4cc21a8.exe	nkdac.exe
PID 1820 wrote to memory of 2060	1820	74f41ef79426aa52f86d56ccf4cc21a8.exe	nkdac.exe

C:\Users\Admin\AppData\Local\Temp\74f41ef79426aa52f86d56ccf4cc21a8.exe
"C:\Users\Admin\AppData\Local\Temp\74f41ef79426aa52f86d56ccf4cc21a8.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\nkdac.exe
"C:\Users\Admin\nkdac.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\nkdac.exe
Filesize
124KB

MD5
00143e3dd8cfe60b710bc1d45f2a59f9

SHA1
7f00d2ec167645a8909746b5d4a2700db92fe7f9

SHA256
713a7737e2e97215801c596efbef1c0b84fc68d871c17ac0cc0af13680cd8cae

SHA512
8242654ddac13a09b50045a9820b35f0ada04486416c9934f48d3bdbbbeb65293c3100e118f1da6e6d4be0fdbbf624194844d2ea3fc211fab854d5b8569a97a1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads