Analysis
-
max time kernel
74s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
krampus/krampus/Loader5.4.exe
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
krampus/krampus/Loader5.4.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
krampus/krampus/Loader5.4.exe
-
Size
5.4MB
-
MD5
852ac135a3723323566a0c226128913e
-
SHA1
49bfbcf275e5cbdc1bb838bd497fb5a32727c2a1
-
SHA256
07f15b10ba58970acf83de539bc55c726c1cab3c6ee872d4172a1070c983e306
-
SHA512
c0928b9de4c2b8bea188dc1ebbecc76000f3e2aff29fe450ec88de5d28764272f2692e48c761e27113a9617f0210cf9a50cf8c44087a140dcad3f8ace65b4a2c
-
SSDEEP
49152:dXBlVZgljh/jCY7894a1DTMqX/akC6lXVkjU9jD5EHsho/CSymeI7++k604TxNB/:5FlY7AgoC6l/Ert7BLQecp
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3400 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier taskmgr.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Loader5.4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Loader5.4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Loader5.4.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 3400 powershell.exe 3400 powershell.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 808 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3400 powershell.exe Token: SeDebugPrivilege 808 taskmgr.exe Token: SeSystemProfilePrivilege 808 taskmgr.exe Token: SeCreateGlobalPrivilege 808 taskmgr.exe Token: SeSecurityPrivilege 808 taskmgr.exe Token: SeTakeOwnershipPrivilege 808 taskmgr.exe Token: SeBackupPrivilege 4264 svchost.exe Token: SeRestorePrivilege 4264 svchost.exe Token: SeSecurityPrivilege 4264 svchost.exe Token: SeTakeOwnershipPrivilege 4264 svchost.exe Token: 35 4264 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe 808 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1428 wrote to memory of 3400 1428 Loader5.4.exe 82 PID 1428 wrote to memory of 3400 1428 Loader5.4.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\krampus\krampus\Loader5.4.exe"C:\Users\Admin\AppData\Local\Temp\krampus\krampus\Loader5.4.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \"C:\\\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82