Overview

overview

7

Static

static

3

KwSing-v1.6.0.5.exe

windows7-x64

7

KwSing-v1.6.0.5.exe

windows10-2004-x64

7

$PLUGINSDI...if.dll

windows7-x64

3

$PLUGINSDI...if.dll

windows10-2004-x64

3

$PLUGINSDI...64.dll

windows7-x64

3

$PLUGINSDI...64.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ng.dll

windows7-x64

3

$PLUGINSDI...ng.dll

windows10-2004-x64

3

$PLUGINSDI...ew.dll

windows7-x64

3

$PLUGINSDI...ew.dll

windows10-2004-x64

3

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$TEMP/KWMU...te.exe

windows7-x64

7

$TEMP/KWMU...te.exe

windows10-2004-x64

7

$PLUGINSDI...64.dll

windows7-x64

3

$PLUGINSDI...64.dll

windows10-2004-x64

3

$PLUGINSDI...ew.dll

windows7-x64

3

$PLUGINSDI...ew.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

BugReport.dll

windows7-x64

1

BugReport.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    966174e02aa55938e2ce150b301b1b1d

  • Size

    6.8MB

  • Sample

    240212-ga4mfsdf6x

  • MD5

    966174e02aa55938e2ce150b301b1b1d

  • SHA1

    e49a244091d047b15072d5161d286a335b9bd3ac

  • SHA256

    9661762b367c9b9914e02a274fce181229109e5ddadb224a2dd9e047c35c28e5

  • SHA512

    856315ea03641c7f49c4ff80e94bdc35d9c8c66c87b3353a16907b0fdd630fe6ff9b85b1161e6ff650e8f81ffbd4c396fa56bc96bb11e85e9e2b51c9f78d701e

  • SSDEEP

    196608:NqpMTzSWys5rD+JfS5Qsl/icTFnpZwlVTJE:NqGSWyE+JfS5t9icFn/wlY

Score
7/10

Malware Config

Targets

    • Target

      KwSing-v1.6.0.5.exe

    • Size

      6.8MB

    • MD5

      b7a376a229c20e16ae9ad02ec046e614

    • SHA1

      fdd1dcfab14fdf7414c988d6f6ffa75e32155848

    • SHA256

      3e8d2bb5b85ad78a75317b490b06b39d01edceaf6d1e552329b7a2df5a11c30f

    • SHA512

      ddd84372b170e79ca8466ef13f97e93f454d3d430652c522e1d7256f8962e05ecf10d859b1c10b86defa2cec3d05443173f16f6efe1e235bfec11eabe122a1a1

    • SSDEEP

      196608:5y3hG816GrZJ2NnYBkZjFj8KHXS0k3Gg6dx:838816+ZoYEFYKlk3GhD

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/AnimGif.dll

    • Size

      9KB

    • MD5

      11e94fedb34f46458f9dc773a91f2770

    • SHA1

      791cf30880c74df9d6f7c1e637e4fdf5fa88b38a

    • SHA256

      54ccdcb42fb3e63b7a55e8c0e7d12182a0338ea38b106b793ca048000a189ab5

    • SHA512

      57dd38bebdd7d8fbc4b3daeecabc5c2617d4f5b2f6ad2396a702f1da362bc72deacfea2dd1550b0e00269188676324e1b7dd6ed372211c8bf664af824ac8d950

    • SSDEEP

      96:kVh/i//UrWWXMAb+6aNqRjTwUWo5zFyRH0aTyZekTIVCAEHZNKNy0p:uh/Bl8AIQR/bWSMRH00yQBEH

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/Base64.dll

    • Size

      32KB

    • MD5

      fb6ffa30b708e9413d71a2c95558d0f1

    • SHA1

      a4a67a7b6c53e47f9a741e06c701e03382dc548f

    • SHA256

      3ae1c3fbf851e0de9865191b00b5fc26be32eb4f2ccb81b47e1488c2805402ae

    • SHA512

      b1e4e9e263add6c6d9f7309d739375725f7c4afd645caebea903f7b8963c0ac8d2728dee3edd999f8496b100ba8bd5fd7e5c3c4c17ca0bbcd24923c0cb270415

    • SSDEEP

      384:zFE2o6I2uTFKX342X5xzumltM//yaGPzUo7o5F8:zFES1uTE4W7zwmPzt7o5F8

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      12KB

    • MD5

      1d5c649dde35003a618b9679d5d71b92

    • SHA1

      0409bbab3ab34f8c01289cdd847b4d1a32d05b18

    • SHA256

      0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

    • SHA512

      b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

    • SSDEEP

      384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      32KB

    • MD5

      83142eac84475f4ca889c73f10d9c179

    • SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

    • SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

    • SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • SSDEEP

      384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/KuWoNsis_kwsing.dll

    • Size

      49KB

    • MD5

      42e0843575a679ccda86e3109531310f

    • SHA1

      14af6ec94e196f82dae851d7b34c1d9a1048de12

    • SHA256

      30d11d75cbfe70fbd76ad892ab84626840fa6be6b313edafc103de6c372a76fe

    • SHA512

      13ab8caad4c88f99d3eb83e5600cf6f3e4f0dd06092c47d80da2bfa1d1dd97d6d41155be3b15cee7bd550062c02174487a53eb1c18910beac70d504d0d51b7a8

    • SSDEEP

      768:5B++ELJPIzvpOWb1L3HKEZQR/8JqH8DDd3FLWjbCaR:r++yIjpOWb1L3Kb8JFDDrafCaR

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/KuWoNsis_new.dll

    • Size

      97KB

    • MD5

      f243c563c74cd304f2217f83d8157f55

    • SHA1

      6c191feb9b9fce845afc3801c1abc38244859d87

    • SHA256

      5f0962ab4437230f51023734e6812d3030cdbcc8043984f1aa9cb1a5d69deb99

    • SHA512

      9c2b7ea1bca62b329e7c47dae53faade3e06bddfed176bd4560c6d893851badcc70f305149a7d19bd416ae31c3a2bede30150d9ac951906d9c906374a965f257

    • SSDEEP

      1536:vlC24mOWnZjB9kSN26hzazma4ekJuG3hltjvafCM:vlC24dWxk76hzy2uG3hl1CD

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/KwSingNsis.dll

    • Size

      40KB

    • MD5

      bf46d0f6e813ec922ea1c689de3e6acf

    • SHA1

      a46c9aa38beaf9b638ccce2527f7bfb928635f5b

    • SHA256

      04524aa63010ab03589effc398530dc57e4ad3dabfbabf46af38df449619e5c1

    • SHA512

      4645c334982f321bc8dc4c8178fa55aea7941397cdb5c4487ebe2a90457d2232a35ce9a2bb4fd0754fa3e2d08be41e69d6fcec27a761a798ff7191732e20bcf3

    • SSDEEP

      768:Y18Oq5e5/8tbB3mOuUZaLteiSQ0SakED9sijX:f35eUtN3mOuUZaL0iH0D2ijX

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      4eff5fafd746f5decb93a44e3a3d570c

    • SHA1

      a11aa7681b7e2df1c7f7492a127d332d1495ea8a

    • SHA256

      cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

    • SHA512

      cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

    • SSDEEP

      192:0OycJo/rJVCmIDNLU0dq5RD00lspbub76yL:6/QQ0d0RD0USq/6y

    Score
    3/10
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      18KB

    • MD5

      94a8ace2be90a687c1b1729c32c66e50

    • SHA1

      94cff89cc170c00b1f849460f78cb12ab8730538

    • SHA256

      1a6c160fd844dea35195371476119f91eab302d701b0f6f1c3fe87ad92cc93df

    • SHA512

      ba23dfa7a29450451ac3f6ef6bf9e89352e1d17f7a2b7c7e5a87839becd6676542d2189d443322b3cad08b1bcac8851eebf9964fa37190e551f0bd717dcc5deb

    • SSDEEP

      384:jlkcI7HjShsRSSMxCkRimJrr7Jsc8Xtya9zT0Ac9khYLMkIX0+GiBgAqkF:jEjVQRjRiml5vSQa9zSm

    Score
    3/10
    behavioral19behavioral20

    • Target

      $TEMP/KWMUSIC/DownloadUpdate.exe

    • Size

      119KB

    • MD5

      10ec15eb29b071eb1073b48c6c1b7678

    • SHA1

      7fb49616109fee0abda4185f3fe77106594ef976

    • SHA256

      e14fa67ee50836ad7573fd7ea443bce6bcd2a86e730e71c8c4248a5f108101a5

    • SHA512

      86f52099138397434488aaacb30d5d0125081f1928e385117d59e581ade3eafb8c554f9e7763a976d8645bbaaf6bea6b6fe03b51d8900d10a3af10403764f3b0

    • SSDEEP

      3072:4ZGlFw7fonu4sPJBWU4LATKscUoENR5lfxzbl+/:YWwMnudZiCRcWBlZvl+/

    Score
    7/10

    • Loads dropped DLL

    behavioral21behavioral22

    • Target

      $PLUGINSDIR/Base64.dll

    • Size

      32KB

    • MD5

      fb6ffa30b708e9413d71a2c95558d0f1

    • SHA1

      a4a67a7b6c53e47f9a741e06c701e03382dc548f

    • SHA256

      3ae1c3fbf851e0de9865191b00b5fc26be32eb4f2ccb81b47e1488c2805402ae

    • SHA512

      b1e4e9e263add6c6d9f7309d739375725f7c4afd645caebea903f7b8963c0ac8d2728dee3edd999f8496b100ba8bd5fd7e5c3c4c17ca0bbcd24923c0cb270415

    • SSDEEP

      384:zFE2o6I2uTFKX342X5xzumltM//yaGPzUo7o5F8:zFES1uTE4W7zwmPzt7o5F8

    Score
    3/10
    behavioral23behavioral24

    • Target

      $PLUGINSDIR/KuWoNsis_new.dll

    • Size

      101KB

    • MD5

      5b7d3fc9651089f373df83a9bdc922a7

    • SHA1

      e0ee059b261e89bef6bdc9392ea4a579686a410f

    • SHA256

      cb1e6695c6d55c3bd4b8d12cbe6a2e48687e72c84223256a3431560b2d4d7e59

    • SHA512

      5feaf4de80e9057c9b3fc2d5ef2a5b7ef857fa7de67e5e5aa56915d06cd42b8544a8e707140bf182ad4907fc51a022fa597316f27e481abe170ba2548d64f911

    • SSDEEP

      1536:D3h2lAZyQr64O173t81vfTvkrkuV4OclyTJafC1:Lh2l0yG6Z3O13y4OcluUC

    Score
    3/10
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      4eff5fafd746f5decb93a44e3a3d570c

    • SHA1

      a11aa7681b7e2df1c7f7492a127d332d1495ea8a

    • SHA256

      cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

    • SHA512

      cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

    • SSDEEP

      192:0OycJo/rJVCmIDNLU0dq5RD00lspbub76yL:6/QQ0d0RD0USq/6y

    Score
    3/10
    behavioral27behavioral28

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      18KB

    • MD5

      94a8ace2be90a687c1b1729c32c66e50

    • SHA1

      94cff89cc170c00b1f849460f78cb12ab8730538

    • SHA256

      1a6c160fd844dea35195371476119f91eab302d701b0f6f1c3fe87ad92cc93df

    • SHA512

      ba23dfa7a29450451ac3f6ef6bf9e89352e1d17f7a2b7c7e5a87839becd6676542d2189d443322b3cad08b1bcac8851eebf9964fa37190e551f0bd717dcc5deb

    • SSDEEP

      384:jlkcI7HjShsRSSMxCkRimJrr7Jsc8Xtya9zT0Ac9khYLMkIX0+GiBgAqkF:jEjVQRjRiml5vSQa9zSm

    Score
    3/10
    behavioral29behavioral30

    • Target

      BugReport.dll

    • Size

      15KB

    • MD5

      e713776ed5937eca3bc7e6cacf7aa1e7

    • SHA1

      9d793dad93579c047f11fbdeea1bce5ead65da87

    • SHA256

      d481eeaa880e46d3b3c2b72644a5adb13f554febf404b3a7636586c6c168b229

    • SHA512

      c590088a6960a7262b2deea2c615190f344499617f6fdc01a0a281a1c546462a4083430a940d75cb9a2685eb1134ed90d10d411de60f631cd207fca198046f94

    • SSDEEP

      384:8rt5QLwyzLMzHze2pTX4dYJLu10ASSbC4m:8XqzLMHe2J4ILWjbCV

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks