Analysis
-
max time kernel
247s -
max time network
258s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
19/04/2024, 21:24
General
-
Target
kontur.plugin.admin.exe
-
Size
6.8MB
-
MD5
46737af4e83641478d92673b628f9c1d
-
SHA1
fc430ccc59ad619f9515e698539d17d0204fb9d3
-
SHA256
3c5af1a894a355a2f50206ac5923d084166e3debc6e1cf417f3393b46480b39c
-
SHA512
c60409832f63693cf61616a3865098a9efdf2affba662baf7c1b620e1b2529efc7a5124db2f9d147507cdfb36691b92c2f92cfcc17353ad12ead8a7327a250cf
-
SSDEEP
196608:J6S778UHVROrhCIjXXoKkqYbGXZKk3POHdM:J86rOrbHoK7iEKc+m
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 18 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kontur.plugin.admin.exe"C:\Users\Admin\AppData\Local\Temp\kontur.plugin.admin.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe"C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe" rtpkcs11ecp2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe"C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe" rtpkcs112⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe"C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe" jcpkcs11-22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\kontur.plugin.admin.exe"C:\Users\Admin\AppData\Local\Temp\kontur.plugin.admin.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe"C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe" rtpkcs11ecp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe"C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe" rtpkcs112⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe"C:\Program Files (x86)\SkbKontur\Plugin\4.2.2.488\pkcs11check.exe" jcpkcs11-22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD50d4ce9343fdebef302f78ad68d5c9a3c
SHA17c1f22c5f567758e774911c67840e86505c3c4dd
SHA256c12e9cc4460e4cf4d90acdbbb7d4058f5e49d20fd761f69eff1207934f48959b
SHA512b494bff30af9091484e044c00cbf7068d51564270fbb6b1e93e502be72571aac8ffe230439c8a3cf3409c11a79a917a15b08a1bb47c6ddc9740c85a0c0f916a6
-
Filesize
6.0MB
MD5e77a72222025f9a3ccce7c65436e6ec9
SHA18ac155e7aba406ef464226ef61fce65c774931c7
SHA256660b0953d754c155ce470bc33055453b6dfd38c1d1506febd5c99473f450c6b5
SHA5129c5d2980c36a3eeaca9db9d544cb15fd55ccf41ad5727b4d7221d3ec212f26a876d323cb6209e5c7655c979b8059697238801ece90af78d128717e884f1a9ea0
-
Filesize
3.5MB
MD576d847d101923262da16d801b7ac9c43
SHA13609fc55e1e6fef0a3e9bf0c02839acf52263333
SHA256f5a21a52bc28cfe5d88a57b499a71f8dc5373ba33ccb13047d82e2a9ed9e049f
SHA512b325c62715ba6cce737dd678e1c623f1b495d3125fd666db82ccbd4c11f68b519dd2cd1565431c8aa103fb63eeaf789fc48689e76127a918bda9916139d01df7
-
Filesize
409KB
MD5e78f646913451e1b379e596f85a12862
SHA1d75de5837dc71c605cd57497b34c9083867ae101
SHA2569741ad9d52cf32c5390607569768b88591ed27dbb635f579ba381aa2533f921e
SHA51205732c6aa67aeea242822f4c7ac3cfaeae92c8bc40f095c7cff339cc469cc84ffa32797ca8578576f45274fe47cdf62ac71bece97e0e3eb7a2f19ee78a9c56c4
-
Filesize
25KB
MD5cbe40fd2b1ec96daedc65da172d90022
SHA1366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA2563ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
SHA51262990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
-
Filesize
540KB
MD530161b954f1e5c72de4029922cf2656b
SHA1b379e8152c8d3d83b779f674e1016943deb2ded9
SHA2569b985d0589b63558d637a63292954bb3794dc0fb4d68dafc5a3c7367b4b9e7e7
SHA512cade35b5837fd70f87d3eaea281551fb335eccc3fc902054fb0211f545a5cdfaddaf1ce2a0d852cc8dc4bcaec2470194d77f105dce142573a2afa03ab5bb0262
-
Filesize
14KB
MD56cbaec4411cc81008e688d0ed3ab3162
SHA124489a6f80bcf7d6814ef65e2600bff7b7960532
SHA25624c81d883f825129b745f7ff1a8a528213338a19b47eeb0d566217c3a72efb7f
SHA5121320e5d5da69bfdddd5747a2c737005c4a5b4073c3d4d22459129816de2faf81f8c116017e05247b540d4228c9ec5f52ee2d3d09b9c94645a87a3b6e2bce0422
-
Filesize
946KB
MD56ca55477bf7df7015ac8c4bea73f1232
SHA1def4844952d9125a30cb7108dd1f1dc43996d8e1
SHA2562d5090552f8fd3b21b3b3c8ff81790fe1ca34faa3be41c04262dee5a147bc37b
SHA5123174932263bc24ec211df018a39657cdb1790e353c36c2fd99786011c1de9f0a386ff054484875148b944648e4b553fce77a7ddad095cceea4d8366e45ce846e
-
Filesize
3.6MB
MD5e18f14dac04fbfeeb9e95acb97bf78e7
SHA128c3f538ff76395b746e5b69573c424ba9b944ac
SHA2567b5a77d48b28afe5383d7348f03d92a1d94b832fec4e16a678ab80e885fd13f1
SHA5129e06f126b0e6bb86b2b5109dd298bdf7a2a3fff0586904a2e7141a78ffb8f128dee3e093ea014bda9d430bbcb1de8f711be338ffcaa5ef4ff7e7122bc37d6344
-
Filesize
1.9MB
MD541e92a8cef201d9ecf0cad68083d4e34
SHA1c3afa17ece06556a6108bc7d0a255e9ea45d961d
SHA25641bec39b3ec60086021af818b43c02b80d05691931fcbd68a74da7fdf1b29755
SHA51278a01839fd713b3052a3d5e894c7cf29e7faa1601ff97bd0f9e9e431be35e1571ba8c0ea675c527a390316428b480d87c889ab6d202902cb5392f819c51c042f
-
Filesize
261KB
MD5a16afa13e12d4cb0120209841ddd9642
SHA1414fce714615e543068b018fcc2b9f8d3e9ac58b
SHA25609e02f7aa589be0c9e5e168edf9218006bdf9bc0f727d383ed932d045ebe925e
SHA5124e5ee0fdeb5dfe93fccc1f6cbaf5ede1fddaf9b3e21c68b434d8aeb533f3aafc25eff0dd966a39cf802a4e732ef28ffc0df7a3f01892bf4e3e02459c0727471e
-
Filesize
213B
MD596f9eef8ae8d43223b52cd85a6e34095
SHA15986ab8dc9f2396b530e9f6a5c1b6de95ff36350
SHA25630665abde24d0b84e2593e21211cb36e62f3c1d1423d55a5f6f6423e23334a9a
SHA5124565f0ad3e00f66ee3c55a0dfdd030f0c13c721a63426343eccbb7f85d7e28744b973d7ac10fc66e29b8784bc9f9a00e1e8297601c25b786ec45b3f52c2ceceb
-
Filesize
248KB
MD53cee879c4ad0f98a5a213bddd02af759
SHA1b317ea89c6801048f50ea7f5a1a5aad88ea70b98
SHA2562949a829f155ea6b4847da2113695ba5bcfdf0a3b86ef71194045017a66c66cf
SHA512029da6ac922f41e5a3d440cdf47a31c4fc9ca09287bfa4e75d680f8c6bbaa4d564741221449f2dc8f8fa07987f5e04a76e12919d6fc602cf85c25a4cf256eee4
-
Filesize
216B
MD5060d0b39033ad26579a5a6613f3f1e12
SHA128eb1524ed22baeebdd3cd5c434913c32b37099a
SHA2567281ae686a97a185f9c48c34ae7a73fdea4524af3713d1f5d832af4473d790ca
SHA5127d5e2ab0aceb9018f0302f273195acb73c9fb786e4fa3b3f7a74ee20576374b139c03714b4a6108d3ecac113c9470c8b12d00064a7d06f7ea1b472971762d7dc
-
Filesize
145KB
MD5f9560e8bd7fd622ff220066a7d3f2de4
SHA18882f7ab3b709c7ce456952091b4ea84fb335e05
SHA256f862af5a222f81bc44066a00733b325c02aeff3252edfd9468a5d9a783e5aaba
SHA512d1a7260038afcb8c26ca366a34156e06a1261645b1f47c7b95d8f283f60e5df05ad3120fc62f6f55ffcdfdab5497af55cad8c1dd968b9d969b634dd1c41ac888
-
Filesize
226B
MD52b1ab7b2d1506b623e56a614e90a8c2c
SHA1eca1f67f05ad6e20c5d19c3ce3c061a9935ca202
SHA25675a2eaf4e88326d5604ab1fcd7abc2cd7f6c0f63b4fc3c7fe96b5e08cbfc8421
SHA51215d10e9f8230577ab702d7d74c9332d963c9040cf7c65799c758591a04a0080a31cacaaaabb47a627689ae04d2e675906cb42184c503e83a0abfc2de74c0a3aa
-
Filesize
513B
MD51496b6e33ed4cb12c4d8fcc84e268a7b
SHA18e21c86964e90734cd6305b7814690b233b877dd
SHA2562eb8a41a4b74954faa81b225926c1adfcccfbbc7f94d3af5ffdf4643655e0926
SHA512f6b321b2c336a575be3ffbc39722b1c9acf6b46344ae40fc156932276adc7df04dc2293bfbac2512589e633aeb74fa8478e39db43399ac37265116b94ef5690e
-
Filesize
104KB
MD5c9a339036bdc5205a4c1bb532c61c81f
SHA13964eee8d38cd4778626034a68d7acd3007ff47d
SHA2562c78f2ac46946cbe807ce66d6297d3ec355a9ccbed8a8f858d044456f73b7a2e
SHA512537622f8b0f97b06bea942615b587900ebf7c8d0ae8c59711c7ac1394beb3b36ea135928ebfe15dc8acf6e9d26b7dd81b685c284e185e7200e379e8d66377314
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
4KB
MD52f69afa9d17a5245ec9b5bb03d56f63c
SHA1e0a133222136b3d4783e965513a690c23826aec9
SHA256e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
SHA512bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
-
Filesize
9KB
MD56c3f8c94d0727894d706940a8a980543
SHA10d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA25656b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA5122094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
-
Filesize
7KB
MD5675c4948e1efc929edcabfe67148eddd
SHA1f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA2561076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
SHA51261737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
