Analysis
-
max time kernel
34s -
max time network
21s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-05-2024 20:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kdmapper.exe
Resource
win10-20240404-en
windows10-1703-x64
6 signatures
300 seconds
General
-
Target
kdmapper.exe
-
Size
133KB
-
MD5
c9174fb26e2cd12dc1536418230a346d
-
SHA1
8d53cd6a12626b32536ed80721495fa0bad580cb
-
SHA256
40baa97b2e3c456d1597454d2e85715f5205033ad6998938ec3486695f5e1648
-
SHA512
fc1af5a496a8ec8daced190cf5c0bc7d02cbb9812a2ca82fa5d43237f305f79d007b4f1e73fde2a30bbf09dceb28c4d5e39ee1709b6b49e1cf830074dbc0cd86
-
SSDEEP
3072:tkQjnYpEs+m3veGZ1gSKtYaoGr7mJTQSaMm5/69MfeE9wH:tDYpr/el9wWlkQ6
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4584 taskmgr.exe Token: SeSystemProfilePrivilege 4584 taskmgr.exe Token: SeCreateGlobalPrivilege 4584 taskmgr.exe Token: 33 4584 taskmgr.exe Token: SeIncBasePriorityPrivilege 4584 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe 4584 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kdmapper.exe"C:\Users\Admin\AppData\Local\Temp\kdmapper.exe"1⤵PID:3560
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4584