Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 20:19
Behavioral task
behavioral1
Sample
kcc_5.6.5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
kcc_5.6.5.exe
Resource
win10v2004-20240226-en
General
-
Target
kcc_5.6.5.exe
-
Size
42.9MB
-
MD5
01539eed32d72cdc653cec8b6551f7db
-
SHA1
569fc96ea5bbbd9d8d7d1943bef9134ca6236a05
-
SHA256
a1ed0e58c2c30b3fe1d05f5b27b51e49bf539ed27dbe371f2996dbae3332b9dd
-
SHA512
b521438eecc3ad00ceb2f1d072e0719f7bda45428b03a6ef127037118b34e8ceaced837f8e4e496eaa1e396fe5f0a7f0faff1ef45bdd838bb0a6bc11fa857539
-
SSDEEP
786432:z5B+6VytjvRV7+gX4BMdhwzTQXRsdFbMp3C0Er7lMFcSS5U/LT2KXowkYXk9:zRyRvXlXGMK4XRszbWC0E39SCU/+0pkd
Malware Config
Signatures
-
Loads dropped DLL 50 IoCs
pid Process 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 868 kcc_5.6.5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 868 kcc_5.6.5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 868 kcc_5.6.5.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe 868 kcc_5.6.5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 868 kcc_5.6.5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1752 wrote to memory of 868 1752 kcc_5.6.5.exe 91 PID 1752 wrote to memory of 868 1752 kcc_5.6.5.exe 91 PID 868 wrote to memory of 5052 868 kcc_5.6.5.exe 93 PID 868 wrote to memory of 5052 868 kcc_5.6.5.exe 93 PID 868 wrote to memory of 2536 868 kcc_5.6.5.exe 94 PID 868 wrote to memory of 2536 868 kcc_5.6.5.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\kcc_5.6.5.exe"C:\Users\Admin\AppData\Local\Temp\kcc_5.6.5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\kcc_5.6.5.exe"C:\Users\Admin\AppData\Local\Temp\kcc_5.6.5.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:5052
-
-
C:\Program Files\7-Zip\7z.exe7z3⤵PID:2536
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD5d396985225d85caa7d743d67c7da6316
SHA1915d5829ed02171684c2a9e8b3b57f7a35bc1e2c
SHA256be2ef4f6d540d0ac5fddd556dcb6bfaf6cb6288679e4d64882d625ff35f173aa
SHA512d7b0df2865bf491c9caf34cbabefb7b7f04b35b85276a59fef0499d02b09651d8f6d0db9e87df4a9a1417f07784a8e5625e9805bc434b87d64e442ab98e24075
-
Filesize
30KB
MD50fe6d52eb94c848fe258dc0ec9ff4c11
SHA195cc74c64ab80785f3893d61a73b8a958d24da29
SHA256446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
SHA512c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
-
Filesize
2.4MB
MD5d6d51c8f5e381cbba49d54e507a41220
SHA186deaab67d3fc4e26bc81db89faec720a5d8a3a4
SHA2565a2aed6f96abec6905e6a36d33bc00d2c23e13f6333ea0545a32ab57b33a7c47
SHA5123b3b386d3d0a8865348a574740473325a1a7deac6a9b767fbca253e1de90412aa76e4e9b36d9586f3307f10ee567adb34d85bf21751e568e86ec66683131fbf0
-
Filesize
2.4MB
MD5a931566050607d6a9feb94cef82672d9
SHA1405a7e907631efef51bea7952d4d725b6402d5a2
SHA2568c425d163b0c650cb8dc4662625de4998bed2ad9a3f2e04a8664e2e72a69f845
SHA512263a23f1346ecf1a042f3c697c8f40aefb99e134c06ee87edeef47c170e7113327a9c51143af83e4fa1589970f22c2606bf6f4bb4ebff7be3ee3e3acfde4a258
-
Filesize
4.9MB
MD59cde8433816662eaeb762c8e6fe77e6b
SHA1d9d69268af89c4134ed94c768baedd6abbce7557
SHA256e732f15729fa69c3067dc33abb60e241570398aa9ab3359d9ff2a9714d1a1e4c
SHA5123f6dfc0fdc9eeb4f5d041aaf5d0420091f7230bf60796e979503d345ce9a74e0f23dd229c31207221c8509bab1edde616ff9803776708a5b4097a7338d372c54
-
Filesize
119KB
MD531fda8b192af6a8ba26cc166d5ebef69
SHA1bf81645b4454d077656810e03fc169a63ee3d3e4
SHA256b7492bb574f1ea88a1eeef3ea4ea0dac21c427ff54294600cf0ea42bb5ca53fd
SHA5127ac94b80c594922d29b9c3b3465d2959c855b31c7d2e9f58b5b683fa9065fafbec639b0b9e42cfec39f448ce55d322db50db118e72f1d174f94bd912551cb475
-
Filesize
4.1MB
MD5a2e58eb43f718c6ab1a52d7b2672816a
SHA12a100a44c088a3411d270d6dca26b7e0c94b84b0
SHA2568a29dd6b4514c466230aaf5d72e2336de55fe7cac0892020fe61cc7e21fcf769
SHA5126b6c741d968aa56ca9deef73ba2951ec9d456e61739da9a640621a3a8ebcc3a7a67a5530ab611a090b5278d317b5f16c17bf6a5c7c266dd4c07c2eaba2ff8b7d
-
Filesize
5.7MB
MD5817520432a42efa345b2d97f5c24510e
SHA1fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA2568d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
SHA5128673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
-
Filesize
5.2MB
MD57c62bd00252ea3ba41d706ab2710a4b8
SHA1ce9a4c3e0c821c8a59388948f80385e692301772
SHA256fd7049d8ef4fe86974e055a30f88295d4f74cef05fc5829edee01eba7a710f78
SHA512cbc2bc310a8fccadc7b8f4e2a0a167b38a2b5594f239034bdf85cd0e1245f51147b7bbec09a37f1110ff092a7a26623c85171a04e6729911f521f083f5fc096d
-
Filesize
4.4MB
MD5e79b5621f96388e21b40314451c57351
SHA12980a7f328a8824ca50d01ed6d15d15ce3f09019
SHA25653914c51e4c2b97936843f45c9428b738cea12fc569968b11229d317e7fa7dca
SHA512dfe0b4f75c48bd3f0f6d054759173adee7f74ff23b4c43db43e3e72ed22c6a6c958f8d7e95426023577c2f680145d52b971940780168a20321915bde59a74d25
-
Filesize
5.2MB
MD54cd1f8fdcd617932db131c3688845ea8
SHA1b090ed884b07d2d98747141aefd25590b8b254f9
SHA2563788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA5127d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
-
Filesize
94KB
MD5a87575e7cf8967e481241f13940ee4f7
SHA1879098b8a353a39e16c79e6479195d43ce98629e
SHA256ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
-
Filesize
36KB
MD537c372da4b1adb96dc995ecb7e68e465
SHA16c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA2561554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
SHA512926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6
-
Filesize
78KB
MD5e877e39cc3c42ed1f5461e2d5e62fc0f
SHA1156f62a163aca4c5c5f6e8f846a1edd9b073ed7e
SHA2564b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f
SHA512d6579d07ede093676cdca0fb15aa2de9fcd10ff4675919ab689d961de113f6543edbceecf29430da3f7121549f5450f4fe43d67b9eab117e2a7d403f88501d51
-
Filesize
116KB
MD5c8f57695af24a4f71dafa887ce731ebc
SHA1cc393263bafce2a37500e071acb44f78e3729939
SHA256e3b69285f27a8ad97555bebea29628a93333de203ee2fae95b73b6b6d6c162b1
SHA51244a1fb805d9ef1a2d39b8c7d80f3545e527ab3b6bfc7abd2f4b610f17c3e6af2ae1fed3688a7cc93da06938ae94e5e865b75937352d12f6b3c45e2d24b6ab731
-
Filesize
57KB
MD54fb84e5d3f58453d7ccbf7bcc06266a0
SHA115fd2d345ec3a7f4d337450d4f55d1997fae0694
SHA256df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c
SHA5121ca574e9e58ced8d4b2a87a119a2db9874cd1f6cedef5d7cbf49abf324fb0d9fb89d8aac7e7dfefbeb00f6834719ed55110bcb36056e0df08b36576ffd4db84c
-
Filesize
149KB
MD580da699f55ca8ed4df2d154f17a08583
SHA1fbd6c7f3c72a6ba4185394209e80373177c2f8d7
SHA2562e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20
SHA51215ea7cd4075940096a4ab66778a0320964562aa4ae2f6e1acbe173cd5da8855977c66f019fd343cfe8dacc3e410edf933bce117a4e9b542182bad3023805fd44
-
Filesize
26KB
MD57e7d6da688789aa48094eda82be671b7
SHA17bf245f638e549d32957a91e17fcb66da5b00a31
SHA2569ad5bcf2a88e1ffff3b8ee29235dc92ce48b7fca4655e87cb6e4d71bd1150afb
SHA512d4c722e741474fe430dd6b6bd5c76367cc01ae4331720d17ed37074ad10493cc96eb717f64e1451e856c863fbb886bdc761d5a2767548874ba67eabf57ac89bd
-
Filesize
72KB
MD57f25ab4019e6c759fc77383f523ef9af
SHA15e6748ce7f6753195117fdc2820996b49fd8d3af
SHA256d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95
SHA512a179b22c61f661e4d9b17f56b6a7f66f2d8d8e1d2a9a8aca3c4d6a9cb7755ce6d223bfbca817c1098692a39b6fc20ffbdacefd9bfb47ff02ffa47badca437514
-
Filesize
152KB
MD5cf2f95ecf1a72f8670177c081eedeb04
SHA16652f432c86718fed9a83be93e66ea5755986709
SHA256ba6025ab22d8e6c5ad53c66dc919f219a542e87540502905609b33dc0a8dddd8
SHA5127e5df920f6acb671e78078e9c4fa3278ae838ea6bef49c0ae44de6a79923a3d7bccf0fb3f0e477ca5092e23450494dee265d8735b24d8026456e1328f6fe8b2e
-
Filesize
20KB
MD5e40fd3e717ac6edbb4238bbf9afa7362
SHA1c4ae109b8cb3dc91cfb7da8e33bb0ef4b1c07a93
SHA256fe822f84185005b2f84189b51226a3591693ec7c936c2fc009139c36493f4cd8
SHA512730bd359a04f3bae3be70b5833ad8147f91df9071b007bd9bfbd09ea332c685c1ce886b955ffc4801ff1ab7fa3354eee3159a9d8ed0d6466e713992be1327c6e
-
Filesize
1.0MB
MD50e4a3cd75e605eee83719960c0cb589d
SHA15b00b2151c35d28d2f9fc526b6c3b34ba05e08e1
SHA256e64d3f12f94137602f282d839550d4d3ef9e4f69981a34fb3d85dd6e23f3f050
SHA51231eaef88584d36c9a4243b67ef61d93d57ff4bafe446ab37d538a2b9741c4820bee33c69891aa464b310735b9e969f3e3f79e4ca551b2ba79c524c6e572bfa8f
-
Filesize
10KB
MD5f33ca57d413e6b5313272fa54dbc8baa
SHA14e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA2569b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
SHA512f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32
-
Filesize
117KB
MD5494f5b9adc1cfb7fdb919c9b1af346e1
SHA14a5fddd47812d19948585390f76d5435c4220e6b
SHA256ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
SHA5122c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794
-
Filesize
3.3MB
MD563c4f445b6998e63a1414f5765c18217
SHA18c1ac1b4290b122e62f706f7434517077974f40e
SHA256664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
678KB
MD5bd857f444ebbf147a8fcd1215efe79fc
SHA11550e0d241c27f41c63f197b1bd669591a20c15b
SHA256b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA5122b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
-
Filesize
65KB
MD53cba71b6bc59c26518dc865241add80a
SHA17e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA256e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
SHA5123ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2
-
Filesize
187KB
MD54135f7cc7e58900575605b7809ef11f9
SHA1500c2d16d0d399ab97db65ca5dc4f9a40925695d
SHA25666b14ebdd917f046315b666f841ea54a32760ecd624863071da8d3f1fd24459b
SHA512c677c1e97e682213245641155210919278b8917e6ed2df756dd181809dd16555b700a063514c327cd8da3183b8d3f492b4b143ed076702889c35a1f53e663686
-
Filesize
60KB
MD564a9384c6b329fb089e4d1657a06b175
SHA1ba0e6fcc3b1406356a40b9d8577b2e7ce69c4aea
SHA256ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d
SHA5129593d38abfd46bb94409838dd9cbe603fbe154fa0043959512afc264dceec50d846eefa409bcf9936ee1a7c7313604a578b4051eb6fd6918f2beb0da6c8ee532
-
Filesize
4.3MB
MD5316ce972b0104d68847ab38aba3de06a
SHA1ca1e227fd7f1cfb1382102320dadef683213024b
SHA25634f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
SHA512a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b
-
Filesize
24KB
MD5589f030c0baa8c47f7f8082a92b834f5
SHA16c0f575c0556b41e35e7272f0f858dcf90c192a7
SHA256b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010
SHA5126761c0e191795f504fc2d63fd866654869d8819c101de51df78ff071a8985541eec9a9659626dfcb31024d25fd47eff42caa2ae85cc0deb8a11113675fac8500
-
Filesize
303KB
MD53d1504137e89bbdc42920321b6a62404
SHA1aaf3032171d358629c32faf2b4bdbecd8c533501
SHA2567924666da4ce0ad24d4b8142b330e6d8e89465cd883934724cd9e4b7d8130f09
SHA512d2d1c307970e867ad0b047245e6f9716510217733b6e170de2605190e96f82373693c8ee9d0e5d52152e688cf19830b03da3fbfb7cc21799116ff053f5a0fd61
-
Filesize
970KB
MD5aad2e99881765464c9ad9ccdbe78f0e0
SHA18634ce21a2683674210e836822fda448262e2e16
SHA256e6287f7ba5892c99da70e9785d320a665809ca8e657a64b9fef1e8afcfb6a2f9
SHA51268d2e898cdd73a3ad41ef3db7a149588a82629ac0628c07606f009bd6a92a62f9816c995b1794c8a957a4f3c55a72fcab17a400a2f55016a0ee8d773a172d002
-
Filesize
1.1MB
MD5ababf276d726328ca9a289f612f6904c
SHA132e6fc81f1d0cd3b7d2459e0aa053c0711466f84
SHA25689c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631
SHA5126d18b28fb53ffe2eebd2c5487b61f5586d693d69dd1693d3b14fb47ca0cd830e2bd60f8118693c2ff2dcb3995bbfcc703b6e3067e6b80e82b6f4666ca2a9c2ca