Overview

overview

10

Static

static

1

kmfk.exe

windows7-x64

10

kmfk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    kmfk.exe

  • Size

    5.2MB

  • Sample

    240502-nmnkbsaa59

  • MD5

    7b94d09d7a163ea69ac507a86c1c69e8

  • SHA1

    1fef4329b5a9ca9a037e9b1f7715f020dc955f40

  • SHA256

    c690a152cb4f33da1c1d408089460cbccdf3dff520f2a93d403f15af6df6cc8f

  • SHA512

    1027b042f70ef0dcff83af0a07ce4e72b835ba62d2ae9d3a6d6578ba306689017e1b4065b160ed295273e8311cb5ade4789db8deaec1da65c3b832a3c8debedb

  • SSDEEP

    49152:MFtkoue3u4BfCwyls7ZRqTHquk3OcIA5EuLg0UC0GSJVnS7dErDb:M3jH+40wjqTHqJEQbgVSCDb

Score
10/10
mimikatzdefense_evasionevasionexecutionimpactransomware

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/anebgqa/d/releases/download/d/mz.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/anebgqa/c/releases/download/c/ps.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/anebgqa/e/releases/download/e/kln.exe

Targets

    • Target

      kmfk.exe

    • Size

      5.2MB

    • MD5

      7b94d09d7a163ea69ac507a86c1c69e8

    • SHA1

      1fef4329b5a9ca9a037e9b1f7715f020dc955f40

    • SHA256

      c690a152cb4f33da1c1d408089460cbccdf3dff520f2a93d403f15af6df6cc8f

    • SHA512

      1027b042f70ef0dcff83af0a07ce4e72b835ba62d2ae9d3a6d6578ba306689017e1b4065b160ed295273e8311cb5ade4789db8deaec1da65c3b832a3c8debedb

    • SSDEEP

      49152:MFtkoue3u4BfCwyls7ZRqTHquk3OcIA5EuLg0UC0GSJVnS7dErDb:M3jH+40wjqTHqJEQbgVSCDb

    Score
    10/10
    defense_evasionevasionexecutionimpactransomwaremimikatz

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • mimikatz is an open source tool to dump credentials on Windows

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks