Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:27
General
-
Target
itadx.exe
-
Size
649KB
-
MD5
5e39f718790c8ab61b5fda0607ab046b
-
SHA1
be58a7d81bec145e61b291b9ba07d153b17fdb1d
-
SHA256
40a4758940e1bce888e96d4aa27c24032805a41700d5a0af5bddc174e247c683
-
SHA512
f08366a667eff30a3cb95f5ce37b712c55cbd251449eed0db24fee39f1a412d4924371db7444478fee7d5ee56a1835f5165bd2772fe7a97d3d94d1d96feed67e
-
SSDEEP
12288:L2qoY5sffWpiTHkfRvEwhc5Yh9gH1NcMRoNvia9N0HFW+DgnhLvLQ9WVB57:1GA0HkpvEwh2Yng8MRoAcCfghLLQ9OBV
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\itadx.exe"C:\Users\Admin\AppData\Local\Temp\itadx.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\bckmsn\bckmsn.exe"C:\Program Files (x86)\bckmsn\bckmsn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237KB
MD5ef5ec12bc67a3391646e48810dd2bab4
SHA1b57e0aa8ade39642f454c1a179be4ff94f427702
SHA2565fcaee3ea4ff2b50085af85f3ddd7ae9cdcebcb7a819c5b5d744fbe91a4293ae
SHA512504702736ced85c8ca01fd7f36a5cc30706254b5fecdb45c05f494d3130f6af08ebc468923aa89a0f95b7b9091f3aa390ff2d5cc5378bedceaef9b4cdd46fcf0
-
Filesize
4KB
MD5b879cab8736199a150f07f551dfc8f2f
SHA1f09ab4bbd42bbc80d5ea7f1c44b2cb54c3541018
SHA256ef6a059c7165ad3bc6060965eb3440544066c10f920045be0a3793970a8843e1
SHA5127a390cd4ef77f1c1685a9d584873e22288ee4fbe7d64d42b2aff3ccc9a307eea6cc4348798bea64e84dd861c77adb0081c9d1b494fe87d405505a92637f92acf
-
Filesize
379KB
MD5607ce5e3f197f37380660eb252f31366
SHA1784b907bb3b2b4b42f86a200d99c9ba6a2638b58
SHA2561b4b0ac73a1ea1167f91f87f5c901d920dd563b5288f869386a75eb694edb516
SHA5120abcade5dcff4b609a33cb57a3130bb40f729e4a2293b6c50f8b5d84a526b054afdfc5c48239de2f190b2daa8302abef67cc077dfa80df1c20fbecd924c6d761
-
Filesize
4KB
-
Filesize
1012KB
-
Filesize
652KB
-
Filesize
1012KB
-
Filesize
652KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB