Overview
overview
7Static
static
7ada83f24db...0a.exe
windows7-x64
7ada83f24db...0a.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$TEMPLATES/Setup.exe
windows7-x64
7$TEMPLATES/Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3KKjie.exe
windows7-x64
7KKjie.exe
windows10-2004-x64
7$EXEDIR/KK...fe.exe
windows7-x64
1$EXEDIR/KK...fe.exe
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3KKjie_safe.exe
windows7-x64
1KKjie_safe.exe
windows10-2004-x64
1KKjie_safe.dll
windows7-x64
1KKjie_safe.dll
windows10-2004-x64
1languages/Chinese.dll
windows7-x64
1languages/Chinese.dll
windows10-2004-x64
1xiezai.exe
windows7-x64
7xiezai.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$TEMPLATES...ft.exe
windows7-x64
1$TEMPLATES...ft.exe
windows10-2004-x64
1$TEMPLATES...ft.exe
windows7-x64
1$TEMPLATES...ft.exe
windows10-2004-x64
1$TEMPLATES/readme.exe
windows7-x64
7$TEMPLATES/readme.exe
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 04:11
Behavioral task
behavioral1
Sample
ada83f24db805cdc68a240df31289f0a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ada83f24db805cdc68a240df31289f0a.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMPLATES/Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMPLATES/Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
KKjie.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
KKjie.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$EXEDIR/KKjie_safe.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$EXEDIR/KKjie_safe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
KKjie_safe.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
KKjie_safe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
KKjie_safe.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
KKjie_safe.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
languages/Chinese.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
languages/Chinese.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
xiezai.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
xiezai.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$TEMPLATES/lianmena/tsoft.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
$TEMPLATES/lianmena/tsoft.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$TEMPLATES/lianmeng/tsoft.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$TEMPLATES/lianmeng/tsoft.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$TEMPLATES/readme.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$TEMPLATES/readme.exe
Resource
win10v2004-20240226-en
General
-
Target
$TEMPLATES/Setup.exe
-
Size
1.8MB
-
MD5
a6f4051f7da492db1ea4096f2effd24c
-
SHA1
e2c64323fb25429f2c0c39cce159b68b43989b6f
-
SHA256
4ffc6508abc6b72a8b552f1ea9a9127c5c201b4e1e07b0918c3b46921dfd5563
-
SHA512
5c108d871b6afc4c1494f9776583e2b02ff6359c0a8bd20ce207d27c95c92610b5f0cf4984d4b1b888a358633547836d344407b161bc156f25fc87771f2ae2ee
-
SSDEEP
49152:Lan3Qme67H9Bt1PA5dHwCUYontVVz3Ap+jJ7MgDVN8jRJ9:2n3Q4dB/PA5m8ovVzzEjH9
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2344 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2344 Setup.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
579B
MD515253c20795bd97d0993ad9726d289e5
SHA105e7280012e67931b1a9ac5f5f0d0e0f22f82e54
SHA2567761ce3a5b16758c39bd2108f2b633c84d788647b82acf83cee2910c178034af
SHA51233c2c19987154f495b107c183f9a1906dfe661b452162b0c0b58fd06eb2ab16c714081e6f62bd561e4e510fabd482e19e20fd25bde18c28a73f9a69f4627f02f
-
Filesize
566B
MD5a654b88af919776bba268800fede7d72
SHA1a84f6a3fb187baf64e1250e19c5c065d0fec0ff4
SHA2567641cfab813656e023c2e9c7f350b1a4542a42dd27c7e40712fdc4a099b6c754
SHA51242b0a623302bd310d8c61abddcd3f0716b7c5655791291ee981a3d9f0b892f1a234cecfd31844ad5a080aecdb4ee6ff9fedce81f6b88af67b594829452e7cccd
-
Filesize
14KB
MD5107737e3282fefd85684f2fa3df6d1c3
SHA13befbcae116a644ae28cebdc1d7dfe6be5c8ca5f
SHA25621042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0
SHA512439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4