Resubmissions
03-01-2022 15:51
220103-tagh5sbdh2 10Analysis
-
max time kernel
1200s -
max time network
1199s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
14-04-2024 13:36
Static task
static1
Behavioral task
behavioral1
Sample
kr.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
kr.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
kr.exe
Resource
win10v2004-20240412-en
General
-
Target
kr.exe
-
Size
786KB
-
MD5
899dc9cc6e7516536bf5e816e8cecf55
-
SHA1
6c07fc00ed2202798194749aa8037bb0ad38bb00
-
SHA256
5f84ad4413ad6dcdea0cb3aa206cc4df29e1bad9d9598912c323c931d568ac90
-
SHA512
445016f0e37ee3ecec319b73713d083711608c044f855e16268f89c88d460e95d85b79d375534ac6b7a4a0e869c49470d49b7e325ff0507c550107d593ae688c
-
SSDEEP
12288:vyxPJa2s86jofrWEuxjcZxyPq8tf8sQ+PRtj3lDsmMHj3N6eiaFmhL+JigR:vyxPJ/s86szWEuKiflOmMDhPEhL+lR
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ultrasearch.lnk kr.exe -
Executes dropped EXE 1 IoCs
pid Process 3912 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 7 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe 1468 kr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1468 kr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1468 wrote to memory of 3912 1468 kr.exe 73 PID 1468 wrote to memory of 3912 1468 kr.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\kr.exe"C:\Users\Admin\AppData\Local\Temp\kr.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:3912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5053b42b42161ceb1732195187b9e7bfc
SHA19ccdbf377aafa033ce41969f11565c5efe60f709
SHA256fdc2090f1446af3d540dea310ebb45343e5654a072431d492335dcc95de0c220
SHA512a64febabc05ddae1aff8cc533901d22a4cc6fbf8c162359ccf412b3db7f928008d39def70719b1b08d262c11eb721d37380d58ef4ac4e156c620dbd5e9f8f559