9661762b367c9b9914e02a274fce181229109e5ddadb224a2dd9e047c35c28e5

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

KwSing-v1.6.0.5.exe
Size

6.8MB
MD5

b7a376a229c20e16ae9ad02ec046e614
SHA1

fdd1dcfab14fdf7414c988d6f6ffa75e32155848
SHA256

3e8d2bb5b85ad78a75317b490b06b39d01edceaf6d1e552329b7a2df5a11c30f
SHA512

ddd84372b170e79ca8466ef13f97e93f454d3d430652c522e1d7256f8962e05ecf10d859b1c10b86defa2cec3d05443173f16f6efe1e235bfec11eabe122a1a1
SSDEEP

196608:5y3hG816GrZJ2NnYBkZjFj8KHXS0k3Gg6dx:838816+ZoYEFYKlk3GhD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2900	DownloadUpdate.exe

Loads dropped DLL 16 IoCs

pid	Process
2536	KwSing-v1.6.0.5.exe
2536	KwSing-v1.6.0.5.exe
2536	KwSing-v1.6.0.5.exe
2536	KwSing-v1.6.0.5.exe
2536	KwSing-v1.6.0.5.exe
2536	KwSing-v1.6.0.5.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe
2536	KwSing-v1.6.0.5.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe
2900	DownloadUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000014395-18.dat	nsis_installer_1

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2536	KwSing-v1.6.0.5.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28
PID 2536 wrote to memory of 2900	2536	KwSing-v1.6.0.5.exe	28

C:\Users\Admin\AppData\Local\Temp\KwSing-v1.6.0.5.exe
"C:\Users\Admin\AppData\Local\Temp\KwSing-v1.6.0.5.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\KWMUSIC\DownloadUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\KWMUSIC\DownloadUpdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KWMUSIC\DownloadUpdate.ini

Filesize
58B

MD5
e599356b2d3ea50f3b209af6e1f18240

SHA1
2285dd83b22741216c7d0896a823d429aa01ad92

SHA256
b99ea0ea5dd85f7393bef6f6d19131dab20bf506ca1dd47cd726b4004d5b2240

SHA512
796c99fb481f136e1d8c926111dc3ed36c8ea7157766c246bbae8aec0d4d2af021b63565ce284c72e4942b0519477390f62dfcf7afe7f85e499427e34684fc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst7EF.tmp\ioSpecial.ini

Filesize
606B

MD5
e85b0350ba3b1358dad44050e078bc78

SHA1
c1e7722567f63c856fbaf74192a96145b4fc1c55

SHA256
76cb4614cc7b8ca7971e78ec79d299248f288e17d883db9f659c1bfc0a1cad52

SHA512
6ec11023b278213bfb44d7928b5297ed8fdf9b28a108d685bdefd92f193ec07af2c385121e865cd36424dd44de8af6014fd0dbe9b82545caeed5f6e96c1b89ac

Download Submit
\Users\Admin\AppData\Local\Temp\KWMUSIC\DownloadUpdate.exe

Filesize
119KB

MD5
10ec15eb29b071eb1073b48c6c1b7678

SHA1
7fb49616109fee0abda4185f3fe77106594ef976

SHA256
e14fa67ee50836ad7573fd7ea443bce6bcd2a86e730e71c8c4248a5f108101a5

SHA512
86f52099138397434488aaacb30d5d0125081f1928e385117d59e581ade3eafb8c554f9e7763a976d8645bbaaf6bea6b6fe03b51d8900d10a3af10403764f3b0

Download Submit
\Users\Admin\AppData\Local\Temp\nst7EF.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
\Users\Admin\AppData\Local\Temp\nst7EF.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
\Users\Admin\AppData\Local\Temp\nst7EF.tmp\KuWoNsis_kwsing.dll

Filesize
49KB

MD5
42e0843575a679ccda86e3109531310f

SHA1
14af6ec94e196f82dae851d7b34c1d9a1048de12

SHA256
30d11d75cbfe70fbd76ad892ab84626840fa6be6b313edafc103de6c372a76fe

SHA512
13ab8caad4c88f99d3eb83e5600cf6f3e4f0dd06092c47d80da2bfa1d1dd97d6d41155be3b15cee7bd550062c02174487a53eb1c18910beac70d504d0d51b7a8

Download Submit
\Users\Admin\AppData\Local\Temp\nst7EF.tmp\KuWoNsis_new.dll

Filesize
97KB

MD5
f243c563c74cd304f2217f83d8157f55

SHA1
6c191feb9b9fce845afc3801c1abc38244859d87

SHA256
5f0962ab4437230f51023734e6812d3030cdbcc8043984f1aa9cb1a5d69deb99

SHA512
9c2b7ea1bca62b329e7c47dae53faade3e06bddfed176bd4560c6d893851badcc70f305149a7d19bd416ae31c3a2bede30150d9ac951906d9c906374a965f257

Download Submit
\Users\Admin\AppData\Local\Temp\nst7EF.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit
\Users\Admin\AppData\Local\Temp\nst927.tmp\KuWoNsis_new.dll

Filesize
101KB

MD5
5b7d3fc9651089f373df83a9bdc922a7

SHA1
e0ee059b261e89bef6bdc9392ea4a579686a410f

SHA256
cb1e6695c6d55c3bd4b8d12cbe6a2e48687e72c84223256a3431560b2d4d7e59

SHA512
5feaf4de80e9057c9b3fc2d5ef2a5b7ef857fa7de67e5e5aa56915d06cd42b8544a8e707140bf182ad4907fc51a022fa597316f27e481abe170ba2548d64f911

Download Submit
\Users\Admin\AppData\Local\Temp\nst927.tmp\inetc.dll

Filesize
18KB

MD5
94a8ace2be90a687c1b1729c32c66e50

SHA1
94cff89cc170c00b1f849460f78cb12ab8730538

SHA256
1a6c160fd844dea35195371476119f91eab302d701b0f6f1c3fe87ad92cc93df

SHA512
ba23dfa7a29450451ac3f6ef6bf9e89352e1d17f7a2b7c7e5a87839becd6676542d2189d443322b3cad08b1bcac8851eebf9964fa37190e551f0bd717dcc5deb

Download Submit