Resubmissions
18-04-2024 11:20
240418-nfk6macg3w 1018-04-2024 11:20
240418-nfh19scg3t 1018-04-2024 11:20
240418-nfheqsbd89 1018-04-2024 11:20
240418-nfghfacg2x 1018-04-2024 11:20
240418-nffwxacg2w 1018-04-2024 09:59
240418-l1f2asba9x 10Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-04-2024 11:20
Static task
static1
Behavioral task
behavioral1
Sample
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe
Resource
win10v2004-20240412-en
General
-
Target
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe
-
Size
350KB
-
MD5
0dc61438b79668900bd081bac6109760
-
SHA1
2ee66fd972c2d28ad30775971ba95056951910f0
-
SHA256
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd
-
SHA512
467b352ce6188e6126050c229cd47b526e83ef3535449c3f02b70491e159523d7cc8ebb28caab4e8d98627a22a0af1faf13b134072309dfe56ad175d18177ca7
-
SSDEEP
6144:RoX0oZ+rm/OV6ZH7XYuB4xpuMadbr2X3f+gOkXdhFr:Ry0xrm/h7XYuWCMaV2XWgO8hFr
Malware Config
Extracted
systembc
knock0909.monster:4035
knock0909.xyz:4035
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
lmpkit.exelmpkit.exelmpkit.exelmpkit.exepid process 2556 lmpkit.exe 816 lmpkit.exe 588 lmpkit.exe 2208 lmpkit.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.ipify.org 11 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exelmpkit.exelmpkit.exedescription pid process target process PID 992 set thread context of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 2556 set thread context of 816 2556 lmpkit.exe lmpkit.exe PID 588 set thread context of 2208 588 lmpkit.exe lmpkit.exe -
Drops file in Windows directory 2 IoCs
Processes:
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exedescription ioc process File created C:\Windows\Tasks\lmpkit.job 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe File opened for modification C:\Windows\Tasks\lmpkit.job 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exepid process 1908 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 1908 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exelmpkit.exelmpkit.exedescription pid process target process PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 992 wrote to memory of 1908 992 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 2556 wrote to memory of 816 2556 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe PID 588 wrote to memory of 2208 588 lmpkit.exe lmpkit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe"C:\Users\Admin\AppData\Local\Temp\318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe"C:\Users\Admin\AppData\Local\Temp\318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
C:\ProgramData\vmhgaj\lmpkit.exeC:\ProgramData\vmhgaj\lmpkit.exe start1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\ProgramData\vmhgaj\lmpkit.exeC:\ProgramData\vmhgaj\lmpkit.exe start2⤵
- Executes dropped EXE
PID:816
-
C:\ProgramData\vmhgaj\lmpkit.exeC:\ProgramData\vmhgaj\lmpkit.exe start1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:588 -
C:\ProgramData\vmhgaj\lmpkit.exeC:\ProgramData\vmhgaj\lmpkit.exe start2⤵
- Executes dropped EXE
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\vmhgaj\lmpkit.exeFilesize
350KB
MD50dc61438b79668900bd081bac6109760
SHA12ee66fd972c2d28ad30775971ba95056951910f0
SHA256318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd
SHA512467b352ce6188e6126050c229cd47b526e83ef3535449c3f02b70491e159523d7cc8ebb28caab4e8d98627a22a0af1faf13b134072309dfe56ad175d18177ca7
-
memory/588-35-0x0000000000D80000-0x0000000000E80000-memory.dmpFilesize
1024KB
-
memory/992-1-0x0000000000E50000-0x0000000000F50000-memory.dmpFilesize
1024KB
-
memory/992-2-0x0000000001190000-0x000000000119A000-memory.dmpFilesize
40KB
-
memory/1908-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1908-5-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1908-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2556-14-0x0000000000D90000-0x0000000000E90000-memory.dmpFilesize
1024KB