Resubmissions
22/04/2024, 07:31
240422-jctalsha7y622/04/2024, 07:29
240422-jbdhrsha6v622/04/2024, 07:28
240422-jay33sha5x6Analysis
- max time kernel
4s - max time network
16s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
22/04/2024, 07:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/websterzipp/KrampusExecutor
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target https://github.com/websterzipp/KrampusExecutor
- Sample240422-jay33sha5x
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 47 raw.githubusercontent.com 46 raw.githubusercontent.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1460 chrome.exe 1460 chrome.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 1460 chrome.exe Token: SeShutdownPrivilege 1460 chrome.exe Token: SeShutdownPrivilege 1460 chrome.exe Token: SeShutdownPrivilege 1460 chrome.exe Token: SeShutdownPrivilege 1460 chrome.exe Token: SeShutdownPrivilege 1460 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe 1460 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2832 1460 chrome.exe 28 PID 1460 wrote to memory of 2832 1460 chrome.exe 28 PID 1460 wrote to memory of 2832 1460 chrome.exe 28 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2580 1460 chrome.exe 30 PID 1460 wrote to memory of 2556 1460 chrome.exe 31 PID 1460 wrote to memory of 2556 1460 chrome.exe 31 PID 1460 wrote to memory of 2556 1460 chrome.exe 31 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32 PID 1460 wrote to memory of 2584 1460 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/websterzipp/KrampusExecutor1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c49758,0x7fef6c49768,0x7fef6c497782⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:22⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:82⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2232 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:12⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:12⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:22⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 --field-trial-handle=1216,i,14833942871141324859,10405315694068847936,131072 /prefetch:82⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3125091bfa90f2b9c42e75500ddd7b70816f8bdaf73e83959582d7af381bfa0c
- MD5 032419ede1d4bfc6ab6c0535b20922c9
- SHA1 5833ce487fe2166416bfbeb16e5cc5b58309086a
- SHA512 f0264a4602352042974df64e31f576e796db6b63ef34acbed832652cddaf39305758d239b021194482db8102013ef5b2c7d7c2bfc7963ae85eb0f5441e7f03f5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 5353a9f5afb4f7dbf9f718d216507f3ed4749fa0d38d88d17bbc240a6c0c0eb1
- MD5 4b6a73e2f6b467181fa28a805228564f
- SHA1 18b89e8f59d21a85aa87aa83968cfe6d35e734b6
- SHA512 33cb05f50ac94b8e0f35330e4b0009a0a8d3a3b28a611cda6d495a63a7b4033319bb60635308b2b87e28107f3bb650d582644bd8db33dd4f2d49c259fc304122
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ee5490f71c4617d81ba3e0e79861adcf232318059c7d7900a256ac9e74abde64
- MD5 2c4b06e20a43e49e64c1ce57e16087e0
- SHA1 b5500b8de3793c5c3a8756699e9d2ce4c3c8f0be
- SHA512 e23888974c97cf8e9ec2ceb52689ec64d4ad5800acd3bc20c50331f80e691887dad9d9ee8e74758f2e883e169b01d3bf808d4237b5ae74fa96926817c027e296
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 bb45e81e78284ca688ca29588a201105939b54ed72523e4e8a080334e974eedd
- MD5 b6c2b3201956ef8e645a7fd00e1405bf
- SHA1 6ec3fe104936ef5100e224dd21934bf6365e7834
- SHA512 4d1874783e667647950f2b3e35676129306e72d795be22f1f7ac3a5402d64a7822fe373a29fcd7b2e1460ea466ec5148c96cbddd49fe943431aab513f32c1e84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 a47acf736c78b044fbd9047caac7ca0bb2a976172abe88aee8e16e4e2a64d45c
- MD5 f81af10e03459dcdbe349a3c1d38544a
- SHA1 0ebf2e45e14e9e6ca7bc79d0ccccc291f2cc7658
- SHA512 a8c4133e9f653b5bbe140e9beb7d468911e60984f3f0bf25cb8462af261bfdcabe13513d4a02ef5647ee3ebb43ee377fcb632d88523f2e5f63c2d1d5e85863d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2994bf3d9c85634d503f192002e73c24cad71a2bdc24941171e93579358f63ed
- MD5 732f4a51fd35c2e792dd6df5b80442a6
- SHA1 89eafe9d30327bf874046e375c8d553add74fb83
- SHA512 486c2a19cf054ae86c1973d1ac98b0e4d71f4e3e73a55302681f10d40520e8a548c0537b46b150f27ebb30e96b7281b64b138cf2e19fc14aebe58298475d3428
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Tar3193.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP