Overview
overview
5Static
static
3K3_RISE_V1....2.exe
windows7-x64
5K3_RISE_V1....2.exe
windows10-2004-x64
5K3_RISE_V1...�!.exe
windows7-x64
1K3_RISE_V1...�!.exe
windows10-2004-x64
1K3_RISE_V1...gr.dll
windows7-x64
1K3_RISE_V1...gr.dll
windows10-2004-x64
1K3_RISE_V1...in.exe
windows7-x64
1K3_RISE_V1...in.exe
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
K3_RISE_V12.3_KEYGEN/R123KeyGen(VIP)V1.2.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
K3_RISE_V12.3_KEYGEN/R123KeyGen(VIP)V1.2.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
K3_RISE_V12.3_KEYGEN/先运行我!.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
K3_RISE_V12.3_KEYGEN/先运行我!.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
K3_RISE_V12.3_KEYGEN/替换文件/KdSvrmgr.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
K3_RISE_V12.3_KEYGEN/替换文件/KdSvrmgr.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
K3_RISE_V12.3_KEYGEN/替换文件/kdmain.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
K3_RISE_V12.3_KEYGEN/替换文件/kdmain.exe
Resource
win10v2004-20240226-en
General
-
Target
K3_RISE_V12.3_KEYGEN/R123KeyGen(VIP)V1.2.exe
-
Size
1.1MB
-
MD5
34e0a21c41a4d87f62f0f9cc5a056f86
-
SHA1
0b67356eee8cf21d96d784c4eb20daa522dbf2a1
-
SHA256
e5774c3fbb375047bada45ca6301c736c37bb35fb5498a2fbcfb74d65e6e07d3
-
SHA512
e9f6baded170e1f4d8fbe0dbfa70db32f075494544dc41089564bd295bc8704f9033f8973efdb70b2344afff56cdb9914057b3e04505cd17e56d9108f88b116d
-
SSDEEP
24576:apt3GJcdpUtddoPYcYp4ktRdXkBsXPYRH8vo2ypPqd7oK:+t2+UBbduRH8vo2ypyd0
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4736 R123KeyGen(VIP)V1.2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4736 R123KeyGen(VIP)V1.2.exe 4736 R123KeyGen(VIP)V1.2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4736 R123KeyGen(VIP)V1.2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\K3_RISE_V12.3_KEYGEN\R123KeyGen(VIP)V1.2.exe"C:\Users\Admin\AppData\Local\Temp\K3_RISE_V12.3_KEYGEN\R123KeyGen(VIP)V1.2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4736