cfc350c17f9f21c3cee709494d8945190be0d4838698e9161094f53f52c1bd02

Resubmissions

21-05-2024 19:12

21-05-2024 19:09

max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:09

Target

KAKEInjector.exe
Size

13.5MB
MD5

f1053bd6f2f6b5dd74d81af9db452f1f
SHA1

aa5f30c818dd8196e569c39126e73fb277fdc787
SHA256

cfc350c17f9f21c3cee709494d8945190be0d4838698e9161094f53f52c1bd02
SHA512

fc7455866addddda8850994b7b14f3dc3ad565f0dc5b6005699ea2a85b849cc3c331039905b19705e42d5194d65cbb9a1d3040be84636db14ff79eea963c204c
SSDEEP

393216:LD1rmILrAI3XmgJyL/s2jeUaUXtnseecncyeaGNjRtP7J/2g:n1rTvBXmUwljCebcyfGzl9

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral1/memory/2728-3-0x00007FF63D9A0000-0x00007FF63F308000-memory.dmp	themida
behavioral1/memory/2728-8-0x00007FF63D9A0000-0x00007FF63F308000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

KAKEInjector.exe

pid process

2728 KAKEInjector.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

KAKEInjector.exe

pid process

2728 KAKEInjector.exe
2728 KAKEInjector.exe

pid	process
2728	KAKEInjector.exe

pid	process
2728	KAKEInjector.exe
2728	KAKEInjector.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

KAKEInjector.execmd.exe

description	pid	process	target process
PID 2728 wrote to memory of 2400	2728	KAKEInjector.exe	cmd.exe
PID 2728 wrote to memory of 2400	2728	KAKEInjector.exe	cmd.exe
PID 2400 wrote to memory of 972	2400	cmd.exe	certutil.exe
PID 2400 wrote to memory of 972	2400	cmd.exe	certutil.exe
PID 2400 wrote to memory of 2824	2400	cmd.exe	find.exe
PID 2400 wrote to memory of 2824	2400	cmd.exe	find.exe
PID 2400 wrote to memory of 400	2400	cmd.exe	find.exe
PID 2400 wrote to memory of 400	2400	cmd.exe	find.exe
PID 2728 wrote to memory of 3780	2728	KAKEInjector.exe	cmd.exe
PID 2728 wrote to memory of 3780	2728	KAKEInjector.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe
"C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe" MD5
    3⤵
    PID:972
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2824
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3780

memory/2728-0-0x00007FF63DA4D000-0x00007FF63E584000-memory.dmp

Filesize
11.2MB

Download
memory/2728-2-0x00007FFF68DC0000-0x00007FFF68DC2000-memory.dmp

Filesize
8KB

Download
memory/2728-1-0x00007FFF68DB0000-0x00007FFF68DB2000-memory.dmp

Filesize
8KB

Download
memory/2728-3-0x00007FF63D9A0000-0x00007FF63F308000-memory.dmp

Filesize
25.4MB

Download
memory/2728-7-0x00007FF63DA4D000-0x00007FF63E584000-memory.dmp

Filesize
11.2MB

Download
memory/2728-8-0x00007FF63D9A0000-0x00007FF63F308000-memory.dmp

Filesize
25.4MB

Download