Overview
overview
7Static
static
7ada83f24db...0a.exe
windows7-x64
7ada83f24db...0a.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$TEMPLATES/Setup.exe
windows7-x64
7$TEMPLATES/Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3KKjie.exe
windows7-x64
7KKjie.exe
windows10-2004-x64
7$EXEDIR/KK...fe.exe
windows7-x64
1$EXEDIR/KK...fe.exe
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3KKjie_safe.exe
windows7-x64
1KKjie_safe.exe
windows10-2004-x64
1KKjie_safe.dll
windows7-x64
1KKjie_safe.dll
windows10-2004-x64
1languages/Chinese.dll
windows7-x64
1languages/Chinese.dll
windows10-2004-x64
1xiezai.exe
windows7-x64
7xiezai.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$TEMPLATES...ft.exe
windows7-x64
1$TEMPLATES...ft.exe
windows10-2004-x64
1$TEMPLATES...ft.exe
windows7-x64
1$TEMPLATES...ft.exe
windows10-2004-x64
1$TEMPLATES/readme.exe
windows7-x64
7$TEMPLATES/readme.exe
windows10-2004-x64
7Analysis
-
max time kernel
210s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 04:11
Behavioral task
behavioral1
Sample
ada83f24db805cdc68a240df31289f0a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ada83f24db805cdc68a240df31289f0a.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMPLATES/Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMPLATES/Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
KKjie.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
KKjie.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$EXEDIR/KKjie_safe.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$EXEDIR/KKjie_safe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
KKjie_safe.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
KKjie_safe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
KKjie_safe.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
KKjie_safe.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
languages/Chinese.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
languages/Chinese.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
xiezai.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
xiezai.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$TEMPLATES/lianmena/tsoft.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
$TEMPLATES/lianmena/tsoft.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$TEMPLATES/lianmeng/tsoft.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$TEMPLATES/lianmeng/tsoft.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$TEMPLATES/readme.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$TEMPLATES/readme.exe
Resource
win10v2004-20240226-en
General
-
Target
KKjie.exe
-
Size
184KB
-
MD5
b9aeb26808660d0e9cffca9db42590f0
-
SHA1
60cc89d6e97a1cdc809bd3f98f1f4323af039f2d
-
SHA256
54160c7d3350b20a4abc569f4543a1bd5001e8612c636a7c49cbe3eaf97e12e4
-
SHA512
1909e40d155b96a3ec5a79bb7fd3afa755bfd4923175d711fcb1bf54ee1f64d625240d7a0ca220012a2bc177e77184bed89fa63949201676ba64c0101e6a4dd8
-
SSDEEP
3072:IoyjBGWMuG4SJJHCiRhafmH4QvaNCj3Vf7pfTLR/bNTubouYKux+PlXEcWxGAc+w:VyjZUdnRQeH4QiNCjl75d1ubAV8ZWFcT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2436 KKjie_safe.exe -
Loads dropped DLL 7 IoCs
pid Process 1996 KKjie.exe 1996 KKjie.exe 1996 KKjie.exe 1996 KKjie.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 KKjie.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe 2436 KKjie_safe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2436 KKjie_safe.exe Token: SeIncBasePriorityPrivilege 2436 KKjie_safe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2436 KKjie_safe.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2436 1996 KKjie.exe 29 PID 1996 wrote to memory of 2436 1996 KKjie.exe 29 PID 1996 wrote to memory of 2436 1996 KKjie.exe 29 PID 1996 wrote to memory of 2436 1996 KKjie.exe 29 PID 1996 wrote to memory of 2436 1996 KKjie.exe 29 PID 1996 wrote to memory of 2436 1996 KKjie.exe 29 PID 1996 wrote to memory of 2436 1996 KKjie.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\KKjie.exe"C:\Users\Admin\AppData\Local\Temp\KKjie.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\KKjie_safe.exeC:\Users\Admin\AppData\Local\Temp\KKjie_safe.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5103580e980d6082efc8580953d3692c3
SHA162f3fe6148e99c1ecf65411686cac19ae6d2dafc
SHA256a5d8839e9b015538c54af7b171a47e223f2f1d6b6f28af715341bba95252d318
SHA51214e2f480bc64126b2e20848cc36e774cd5a326e83896de6c64ecd8cea61f665178e41e4999ac17ad3898dd770e1166eb82a460e919dd1eaacc5868a71ecf57a4
-
Filesize
377KB
MD5ac68dffc261c8625c5f2a94364ca10c9
SHA1d5873084dcf4a74631c9abe82f1afc3ba1216464
SHA25616694059e7073810021960bb709f814f42490a5219f7970fa201b3d8ef259db7
SHA512d7ab568b6906d6d0ff924da59983cb8def9cfbb76ed93371e815c26f2f59f3a33edef0e65419bdaee02bcf85efc7a5b856949de5c26afab689aeada50a705b59
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b