Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
03/04/2024, 06:21 UTC
General
-
Target
00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
-
Size
8.9MB
-
MD5
63267d8b3821c488964c7f5dc21ce5f4
-
SHA1
82aceae9a96708e33d3273412ed9d2f1a6581576
-
SHA256
00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9
-
SHA512
75749f274172d15337637c0273576cf0317d713a614baaebbca286fb408f6e28efc3001972dff84b112495169c90279b00f8cf2682345e7ca544a2a09ecf5035
-
SSDEEP
196608:KhUC3fTTEi1xkEqX2PM+PX4SQV6jyi+S7l9I6SI78Bjn5:KhUs/EJS/jkPI4
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe"C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exeC:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe -a -d2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe"C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
-
DNScdnsource.oss-cn-hangzhou.aliyuncs.comRemote address:8.8.8.8:53Requestcdnsource.oss-cn-hangzhou.aliyuncs.comIN AResponsecdnsource.oss-cn-hangzhou.aliyuncs.comIN A118.31.219.201 -
DNSwww.kktian1.comRemote address:8.8.8.8:53Requestwww.kktian1.comIN AResponsewww.kktian1.comIN A120.48.69.102
-
203.107.1.1:443 -
121.196.180.12:443
-
120.48.69.102:80www.kktian1.com
-
180.101.74.77:8088
-
203.107.1.1:443
-
121.196.180.12:443
-
120.48.69.102:80www.kktian1.com
-
192.168.1.20:2000 -
192.168.5.102:2000
-
180.101.74.77:8088
-
127.0.0.1:2000
-
121.196.180.12:443
-
180.101.74.77:8088
-
203.107.1.1:443
-
121.196.180.12:443
-
180.101.74.77:8088
-
203.107.1.1:443
-
121.196.180.12:443
-
180.101.74.77:8088
-
120.48.69.102:80www.kktian1.com
-
120.48.69.102:80www.kktian1.com
-
120.48.69.102:80www.kktian1.com
-
120.48.69.102:80www.kktian1.com
-
120.48.69.102:80www.kktian1.com
-
120.48.69.102:80www.kktian1.com
-
8.8.8.8:53cdnsource.oss-cn-hangzhou.aliyuncs.comdns
DNS Request
cdnsource.oss-cn-hangzhou.aliyuncs.com
DNS Response
118.31.219.201
-
8.8.8.8:53www.kktian1.comdns
DNS Request
www.kktian1.com
DNS Response
120.48.69.102
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD59531abc210972973d25f5a08e3166389
SHA143e54f65eaf479fe2b4241531d00bf326b9393f3
SHA2561f4509f7187154e580e2c89a782dc257933f9436bac4ff28cb7db90af9973946
SHA512aa48c61c248d651b3a0c71464e27b659861bceecfe513a5111d7dcf221bd840cd6c72478d75be7baaafdde2f6a990470460b0fe79aecc808939062ef9698acd2
-
Filesize
332KB
MD58722259b998800a37c3991c58ce64f96
SHA1d370272422272eaf9aca8bc17ba9bcba1b83df70
SHA256b115d63bee020042256019ee14fa0570483180e29c4deb7ed5b8fab522b05244
SHA512867872e22769ecdba19daca70d6ef2bbb9e310abd90ddd1c3ff5b9a3375ef11488f1f7ac021c579ab58b7e8125c8bada584a1e96bb15fcee5837307cb64a6857
-
Filesize
53KB
MD50eed4533257c57e70dfb96753e2d7afa
SHA1b876936f10597e2f1b15a0af35da644076030376
SHA25694fe80ee719e02e036902cc661b2ba07172de611afc3a2b8da45f1ec87bfde46
SHA51266644a6bb211a7e3999c5ffe5301ded2e5b5f29ef1be098d3d38719758fd4f3b49fdc76623381e3d14619bf66afba65ce36ad20e299a1f63b8cdd79eee306445
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
12.3MB
-
Filesize
412KB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
8KB
-
Filesize
12.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
12.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.3MB
-
Filesize
4KB
-
Filesize
12.3MB
-
Filesize
104KB
-
Filesize
12.3MB
-
Filesize
104KB
-
Filesize
12.3MB
-
Filesize
104KB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
104KB
-
Filesize
12.3MB
-
Filesize
104KB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
104KB
-
Filesize
12.3MB
-
Filesize
104KB