Resubmissions
03-01-2022 15:51
220103-tagh5sbdh2 10Analysis
-
max time kernel
1200s -
max time network
1180s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-04-2024 13:36
Static task
static1
Behavioral task
behavioral1
Sample
kr.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
kr.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
kr.exe
Resource
win10v2004-20240412-en
General
-
Target
kr.exe
-
Size
786KB
-
MD5
899dc9cc6e7516536bf5e816e8cecf55
-
SHA1
6c07fc00ed2202798194749aa8037bb0ad38bb00
-
SHA256
5f84ad4413ad6dcdea0cb3aa206cc4df29e1bad9d9598912c323c931d568ac90
-
SHA512
445016f0e37ee3ecec319b73713d083711608c044f855e16268f89c88d460e95d85b79d375534ac6b7a4a0e869c49470d49b7e325ff0507c550107d593ae688c
-
SSDEEP
12288:vyxPJa2s86jofrWEuxjcZxyPq8tf8sQ+PRtj3lDsmMHj3N6eiaFmhL+JigR:vyxPJ/s86szWEuKiflOmMDhPEhL+lR
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
kr.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ultrasearch.lnk kr.exe -
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 2256 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 api.ipify.org 4 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
kr.exepid process 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe 3464 kr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
kr.exepid process 3464 kr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
kr.exedescription pid process target process PID 3464 wrote to memory of 2256 3464 kr.exe GetX64BTIT.exe PID 3464 wrote to memory of 2256 3464 kr.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kr.exe"C:\Users\Admin\AppData\Local\Temp\kr.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:2256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD56c2e94557a9d2111b4ab203bc668f621
SHA1ccafe709c45a8786bc962a79209a4de4d685b3d8
SHA256e6e48d7d4ec5708cabaec6e4164d875100385c211b313af49d3816492a49588b
SHA512b37a87bf5f2d6267d02ab34fe15bfbd4c71dc1f51228f2f3e0db02e3d4d69dd405d717ea118b342b7209c711fc5b992db03799ae76e6c1f5dcd04bde40d86e40