Analysis Overview
SHA256
13c42d320f8be737c8fcbb72a24cedad7c5bf22e12f09d5775a711d715f5a983
Threat Level: Shows suspicious behavior
The file Karma.rar was found to be: Shows suspicious behavior.
Malicious Activity Summary
UPX packed file
Loads dropped DLL
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates physical storage devices
Detects Pyinstaller
Unsigned PE
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-26 02:38
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral4
Detonation Overview
Submitted
2024-05-26 02:38
Reported
2024-05-26 02:41
Platform
win10v2004-20240426-en
Max time kernel
134s
Max time network
126s
Command Line
Signatures
Loads dropped DLL
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2244 wrote to memory of 1908 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe |
| PID 2244 wrote to memory of 1908 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Karma\main.exe
"C:\Users\Admin\AppData\Local\Temp\Karma\main.exe"
C:\Users\Admin\AppData\Local\Temp\Karma\main.exe
"C:\Users\Admin\AppData\Local\Temp\Karma\main.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:54181 | tcp | |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI22442\ucrtbase.dll
| MD5 | b0397bb83c9d579224e464eebf40a090 |
| SHA1 | 81efdfe57225dfe581aafb930347535f08f2f4ce |
| SHA256 | d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66 |
| SHA512 | e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\python39.dll
| MD5 | 2135da9f78a8ef80850fa582df2c7239 |
| SHA1 | aac6ad3054de6566851cae75215bdeda607821c4 |
| SHA256 | 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3 |
| SHA512 | 423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\VCRUNTIME140.dll
| MD5 | f34eb034aa4a9735218686590cba2e8b |
| SHA1 | 2bc20acdcb201676b77a66fa7ec6b53fa2644713 |
| SHA256 | 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1 |
| SHA512 | d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_ctypes.pyd
| MD5 | a1e9b3cc6b942251568e59fd3c342205 |
| SHA1 | 3c5aaa6d011b04250f16986b3422f87a60326834 |
| SHA256 | a8703f949c9520b76cb1875d1176a23a2b3ef1d652d6dfac6e1de46dc08b2aa3 |
| SHA512 | 2015b2ae1b17afc0f28c4af9cedf7d0b6219c4c257dd0c89328e5bd3eee35e2df63ef4fccb3ee38e7e65f01233d7b97fc363c0eae0cfa7754612c80564360d6f |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\base_library.zip
| MD5 | 24701bb1c0d626cfba95d5b1099fbb6b |
| SHA1 | 352a540fae2aaeec3be0530a1f8d798950046484 |
| SHA256 | 66581b32ba0607999d5dde1b7da676fc36e7a8306b4293cba199c16409b28881 |
| SHA512 | bf490defaf78ce3762cb423ba0e6a7cf3d72f3f86f079606c471c7c8b0da8c70ffd0db9e0a13af953e9898b69f8d501adba57c37686bb5a1ad95711159b2a017 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_socket.pyd
| MD5 | cd56f508e7c305d4bfdeb820ecf3a323 |
| SHA1 | 711c499bcf780611a815afa7374358bbfd22fcc9 |
| SHA256 | 9e97b782b55400e5a914171817714bbbc713c0a396e30496c645fc82835e4b34 |
| SHA512 | e937c322c78e40947c70413404beba52d3425945b75255590dedf84ee429f685e0e5bc86ad468044925fbc59cf7ec8698a5472dd4f05b4363da30de04f9609a5 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\select.pyd
| MD5 | 35bb285678b249770dda3f8a15724593 |
| SHA1 | a91031d56097a4cbf800a6960e229e689ba63099 |
| SHA256 | 71ed480da28968a7fd07934e222ae87d943677468936fd419803280d0cad07f3 |
| SHA512 | 956759742b4b47609a57273b1ea7489ce39e29ebced702245a9665bb0479ba7d42c053e40c6dc446d5b0f95f8cc3f2267af56ccaaaf06e6875c94d4e3f3b6094 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_ssl.pyd
| MD5 | 70014e88ecf3133b7be097536f77b459 |
| SHA1 | 5d75675bb35ba6fae774937789491e051e62a252 |
| SHA256 | d318795c98c5f3c127c8e47220a92acba0736daf31bab0dc9c7e6c3513bb2aa3 |
| SHA512 | aa59b32c9164afca1b799e389c7087e95eeaa543790b6f590f9e30aa13b7fdb8cc83d0ef6351f0b578a4da636f4ca1e6dfe4558dcf3a813b744a80f7392aa462 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\libssl-1_1.dll
| MD5 | de72697933d7673279fb85fd48d1a4dd |
| SHA1 | 085fd4c6fb6d89ffcc9b2741947b74f0766fc383 |
| SHA256 | ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f |
| SHA512 | 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\libcrypto-1_1.dll
| MD5 | ab01c808bed8164133e5279595437d3d |
| SHA1 | 0f512756a8db22576ec2e20cf0cafec7786fb12b |
| SHA256 | 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55 |
| SHA512 | 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_asyncio.pyd
| MD5 | a3f434f6cfd2f339876e7d345fe178fb |
| SHA1 | ff71d1a2edc691491394517de2c32f2134925776 |
| SHA256 | 102043b17c20043e4624f60e444131382363b69ff0e683c13fa17af156766483 |
| SHA512 | 6f2d69627a7f01f295add9f1b333bfdba34eae56b04a574227c2ece315ab803683dc3d38b70b095736d2cbc68b3463dd16e54e9c66b757ecb28ad1297e617632 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_overlapped.pyd
| MD5 | fa44f2ac914b98bcec6dd102ec612f87 |
| SHA1 | 4840ce511f46ff9523fa1874f70463491282697f |
| SHA256 | ac33b6b3aacc31d2db8a502110881b4b711e2fb94983f85581e30953c9ac4721 |
| SHA512 | e6d691bc8622a616c7ebe98c362b7b9257c1840bee15161941a1e43a228e48985cb81ecdf41a8d4f60b6bf11a1dec16e81c12576d0ca00e6047e621f7dda3538 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_bz2.pyd
| MD5 | b024a6f227eafa8d43edfc1a560fe651 |
| SHA1 | 92451be6a2a6bfc4a8de8ad3559ba4a25d409f2e |
| SHA256 | c0dd9496b19ba9536a78a43a97704e7d4bef3c901d196ed385e771366682819d |
| SHA512 | b9edb6d0f1472dd01969e6f160b41c1e7e935d4eebcaf08554195eb85d91c19ff1bfbc150773f197462e582c6d31f12bd0304f636eb4f189ed3ed976824b283e |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_lzma.pyd
| MD5 | 77b78b43d58fe7ce9eb2fbb1420889fa |
| SHA1 | de55ce88854e314697fa54703a2cd6cc970f3111 |
| SHA256 | 6e571d93ce55d09583ec91c607883a43c1da3d4d36794d68c6ecd6bea4ab466a |
| SHA512 | 7b03b7d3f2fd9b51391de08e69ca9156a0232b56f210878a488b9d5a19492ab5880f45d9407331360fbe543a52c03d68f68da4387bf6a13b20ec903a7b081846 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_queue.pyd
| MD5 | 328e41b501a51b58644c7c6930b03234 |
| SHA1 | bc09f8b62fec750a48bafd9db3494d2f30f7bd54 |
| SHA256 | 2782cf3c04801ede65011be282e99cd34d163b2b2b2333fd3147b33f7d5e72ab |
| SHA512 | c6e6e6bca0e9c4e84f7c07541995a7ee4960da095329f69120ba631c3c3e07c0441cf2612d9dcc3d062c779aec7d4e6a00f71f57cc32e2a980a1e3574b67d248 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_multiprocessing.pyd
| MD5 | d01d2743f2e38d40722c3f219a4950c6 |
| SHA1 | 839f4814e9c90726e02d46aae2c9f5139415ea48 |
| SHA256 | 336d2d5f4e4bebd6b3823dd218dcaec49bbbe902ddeae9ecd66e4cde1b2bda6e |
| SHA512 | 931561f1568aefdce5fac02136e49398dbc692157e9f9bd0cf111357d46e3b14b757a42ea97d3539f203c18324cef76680fdf81191b47a2bcd1ea86b3d34b570 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\class_validators.cp39-win_amd64.pyd
| MD5 | da0f17763cbf3d2c16c5f41e7680cf47 |
| SHA1 | 6d4d28c16d5406f0bedee103305233b436e83b26 |
| SHA256 | 1d220da3f7824d88ae987e067fc5274d59eb624014f0d6cb7a873810604dd806 |
| SHA512 | a5b93df994a3280f54acae33567a98698bebac305accf96a4cc61e052543a7556de2af213569ffe5643544053ae505150b91ad956bd5a04520887128372a1647 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_decimal.pyd
| MD5 | ff0bf710eb2d7817c49e1f4e21502073 |
| SHA1 | 26d4499af20aa2d154eb75835f6729004b4f079f |
| SHA256 | c6eb532da62a115ae75f58766b632e005140a2e7c9c67a77564f1804685a377f |
| SHA512 | 6cc6a2cc986c84c00a51e1823de4eb56672b36f6ff4c4b23f43c93fd39d68fd99d5b51df6374e7b7f89ac945c0b421bb6bade9a458dd43c3d9721aadbbcd2315 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\json.cp39-win_amd64.pyd
| MD5 | b3dd07e9382a01627c4780505f112cea |
| SHA1 | ed5afecdcc9677c8fc3a2bad5982843e1405addf |
| SHA256 | 6c61149f8ba5a17ae445d120c7ae9f3386fa60f460256dcf76e6e3decf77dece |
| SHA512 | 2c1c676f475f02657e3a50960d365fd6dad03bcc29849603934ee8c422d6d035ef9864bbcbff0d79146337ddc6a3e5149296a28b401d79c31d2f8ed9eb1e1ffa |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_uuid.pyd
| MD5 | d7074a9d35ed4ff90b93660ed4f1ba75 |
| SHA1 | 418f4e62c61b30aece854551a5b629d23eaad010 |
| SHA256 | c4ce019fbd541918d3e7ddf7845bf0449068fc7eee3b57da730860fc7741d561 |
| SHA512 | 6cf06012683aa4fbd85341e496434add21eaa6c72b8100a4ea2539702062860f97ab8b324064ad0689faa81762f4961d956047130d8a14a543ccf0c57a05173c |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\validators.cp39-win_amd64.pyd
| MD5 | 3afb519490a5b0f135737288597dbf72 |
| SHA1 | 6afbbab7869f80623b8a0ebbf9be12952c3cc63c |
| SHA256 | 253bfaba44d191fe8757ca593375d15d4dfb423e657b4fda6e5832be96d0c9bf |
| SHA512 | 34f3c8818371e293973f9d1ab926c621d6c2ddff237460623403cf85cb675351d710fb677875143a3c985d3520453608484bac6244a42b4407b1c71434a27220 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\networks.cp39-win_amd64.pyd
| MD5 | d3556de0ffaeb2e127c8e75aa9955feb |
| SHA1 | 2694947e51df65b3d7df57aa2b08a6444b453327 |
| SHA256 | 296215dfb807aead16d4fedaf64009fbd0879f7684ff81d55f497082e4e8ef7c |
| SHA512 | cc5bd4816f87caedd14a0e7e08e640296734f8c56efe93bd17a2fd3720739401acc0f3d9730c2685d05d98fa892713c602197e06499f09b21d2f865e836bb572 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\color.cp39-win_amd64.pyd
| MD5 | 0a80815d8dd330c49053f1ff96625d07 |
| SHA1 | 425a6d2d67db167b10a1c0d803a06227c8c1fedf |
| SHA256 | 27116258557b71626e22116c4091935b5dac95c8b000344eb1fbce0fbdfb98e2 |
| SHA512 | 15e93ca446d145e71d430d79c2310f6e68e2d5f3103ae1d0ccf6406c307062a6e2df0e55863dd4637f6a6df7b9dac4c594abdf7b07e2b8e1d5d74ca17dcdb353 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\error_wrappers.cp39-win_amd64.pyd
| MD5 | 78f92ae5d1be8462ed7c34f307fcbf24 |
| SHA1 | 638aaf0b23272bec40e9062b8f62cd02f6042291 |
| SHA256 | a2226d4fb43af1661669454f24b78dd5893b0be04c0333cbe282f23817bbae07 |
| SHA512 | 66244be7dccd8934d1884a3e66bdd22d98cf65a300d87355884f2dab3c1fefac47d2c07cecd60bfa90bbfa66d6e41b3d519617646248a6567f2528b4608d263a |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\config.cp39-win_amd64.pyd
| MD5 | ec31006e382ceff44d7ea67c5cd344d8 |
| SHA1 | 7baa97769f44285a670bee7379cdeb8333023e69 |
| SHA256 | b8c51e11156f036ceb4dbe4bbb029cd0badbf00de6f32f53cc4d5645bc92e371 |
| SHA512 | be4ae50e22864d057e06c68c2c3b6651440c2628808e516eeaec4961c4764f878c374e6abc0ae85740c6b8b4581f3db0b1a9474f31a8a578e29b746af4eaa7c3 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\version.cp39-win_amd64.pyd
| MD5 | ecec157f89f5f77fc92b3a3d13db2028 |
| SHA1 | f770aca2e2557aa1ab156c810fcb54e794d04438 |
| SHA256 | ccc9bdc1683da9226cf504b1790db93d8e75f32c3bd22b4aede805d86f7698fb |
| SHA512 | 1502e7cd0d5b4b40b0593805a8540c1eedff96d8b120e8306dc7108225fa293327f1722ce156383d21467855e27a67c76839e6db6996c57da7f699f9d7e9c21c |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\utils.cp39-win_amd64.pyd
| MD5 | e2e93c355c94f80a1553f049aa2edf56 |
| SHA1 | 9112f69c4271a831bd3bad637abd98274facf936 |
| SHA256 | 54e00508d1e90f8d58970e89bd682c9278ca09bec279e05da628fab749132513 |
| SHA512 | b7d57996cc4ae1394464804e0cb5c34d61f72705229b394d17e2f92704e4b775c5c0c21a8f10bd725f660b612cff32ea2bb3a077ca70bdc870b91311bd87a03d |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\typing.cp39-win_amd64.pyd
| MD5 | bd16bab4301ad671700fa5d4f298c013 |
| SHA1 | 4ad3d28b93ef5c7f4d1d8f903f1450a4a264a78e |
| SHA256 | b86a4eab7c0b1a8288ab2a6ced9b22f6e9351a2ce7dc8eb78e2decaac662ef6d |
| SHA512 | b649889a3de310e8a4aae3716364ca86125db0c6c3a261cb21e0315facf25671a56313bcffdad93fd474d9608a52531ffd65589d2ae49cd0f71b5bc606e1f6de |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\errors.cp39-win_amd64.pyd
| MD5 | 94f2e4dcdac48d9dc23d25a903866cd5 |
| SHA1 | d85a96f7b3cdab7110ce135f96cf04322d986654 |
| SHA256 | 6a66a26816211ee38b2b63e72abd821345142d6df2f489e809d507a41ac01390 |
| SHA512 | 9401b3af6b0f048192a6f1c9f43964f4343c40c0d20e6b7e995d3409d1f7e9cdc5290124d8d28006b18d2936547cda6ed493cf0be19deb9f124bc486bd1ed978 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\dataclasses.cp39-win_amd64.pyd
| MD5 | f999f411203902c09a64cf0b230fd429 |
| SHA1 | 2d84de61bde077d6e19d8de04d628cb596202ebb |
| SHA256 | 7c97af875d0dba23131dda97bfc42cd69a97c8382b174ff7398ebe8e4536d818 |
| SHA512 | 94f7ec8e3510241a9c041180601b7c313579f7642ffd218228afb82c86169bdb97ecb2e80ef2d5fc850d8b1b879319bf9b328169fb134e62e2ae33a6c62f1502 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\pydantic\__init__.cp39-win_amd64.pyd
| MD5 | b4e5891f88ca3236d289f36260d3808d |
| SHA1 | f710439fb54b832d7e69400e13d382fa14f5988f |
| SHA256 | 29a120f0e6cde186fdf6038ba9e487e8751659afac438ecc533e3bfd377b3c99 |
| SHA512 | 5cf61d8413fc4bdd363991b0d879cb67143919a3455635c3f49b3411b7b43f76673533179de7e865724be30675ea921d86dd94681570f4294aea1031ac00fa98 |
Analysis: behavioral5
Detonation Overview
Submitted
2024-05-26 02:38
Reported
2024-05-26 02:41
Platform
win7-20240221-en
Max time kernel
117s
Max time network
123s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3024 wrote to memory of 2544 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 3024 wrote to memory of 2544 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 3024 wrote to memory of 2544 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2544 wrote to memory of 2832 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2544 wrote to memory of 2832 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2544 wrote to memory of 2832 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2544 wrote to memory of 2832 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | dfe25b005e36163e9c66d747aee91c29 |
| SHA1 | a358348f39057cc2c437fdb0876db0321b062e26 |
| SHA256 | fab7844cef840eefdd890d50f90338f8ff32e1226bef61fed0892fac96b4e37b |
| SHA512 | 5c77fd069879e32902a7cfe10b5259bcb35cd7f3a5ac0de171a2d42604b775851b6316a5247a42ffe0de23eff017d038264137b8df048a170d9c4fb514636ce8 |
Analysis: behavioral6
Detonation Overview
Submitted
2024-05-26 02:38
Reported
2024-05-26 02:41
Platform
win10v2004-20240426-en
Max time kernel
136s
Max time network
112s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-26 02:38
Reported
2024-05-26 02:41
Platform
win7-20240508-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2168 wrote to memory of 2696 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | C:\Windows\system32\WerFault.exe |
| PID 2168 wrote to memory of 2696 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | C:\Windows\system32\WerFault.exe |
| PID 2168 wrote to memory of 2696 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe
"C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2168 -s 376
Network
Files
memory/2168-0-0x0000000140217000-0x00000001410B3000-memory.dmp
memory/2168-1-0x0000000077740000-0x0000000077742000-memory.dmp
memory/2168-3-0x0000000077740000-0x0000000077742000-memory.dmp
memory/2168-5-0x0000000077740000-0x0000000077742000-memory.dmp
memory/2168-6-0x0000000077750000-0x0000000077752000-memory.dmp
memory/2168-8-0x0000000077750000-0x0000000077752000-memory.dmp
memory/2168-10-0x0000000077750000-0x0000000077752000-memory.dmp
memory/2168-15-0x0000000077760000-0x0000000077762000-memory.dmp
memory/2168-20-0x0000000077770000-0x0000000077772000-memory.dmp
memory/2168-18-0x0000000077770000-0x0000000077772000-memory.dmp
memory/2168-16-0x0000000077770000-0x0000000077772000-memory.dmp
memory/2168-13-0x0000000077760000-0x0000000077762000-memory.dmp
memory/2168-11-0x0000000077760000-0x0000000077762000-memory.dmp
memory/2168-23-0x000007FEFD690000-0x000007FEFD692000-memory.dmp
memory/2168-25-0x000007FEFD690000-0x000007FEFD692000-memory.dmp
memory/2168-28-0x000007FEFD6A0000-0x000007FEFD6A2000-memory.dmp
memory/2168-30-0x000007FEFD6A0000-0x000007FEFD6A2000-memory.dmp
memory/2168-31-0x0000000077780000-0x0000000077782000-memory.dmp
memory/2168-33-0x0000000077780000-0x0000000077782000-memory.dmp
memory/2168-35-0x0000000077780000-0x0000000077782000-memory.dmp
memory/2168-40-0x0000000140000000-0x000000014212C000-memory.dmp
memory/2168-38-0x0000000140000000-0x000000014212C000-memory.dmp
memory/2168-41-0x0000000140000000-0x000000014212C000-memory.dmp
memory/2168-42-0x0000000140217000-0x00000001410B3000-memory.dmp
memory/2168-43-0x0000000140000000-0x000000014212C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-26 02:38
Reported
2024-05-26 02:41
Platform
win10v2004-20240508-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe
"C:\Users\Admin\AppData\Local\Temp\Karma\Karma.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | karma.rip | udp |
| US | 172.67.169.234:80 | karma.rip | tcp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.169.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 8.167.79.40.in-addr.arpa | udp |
Files
memory/996-7-0x00007FFD26FD0000-0x00007FFD26FD2000-memory.dmp
memory/996-6-0x0000000140217000-0x00000001410B3000-memory.dmp
memory/996-5-0x00007FFD24E10000-0x00007FFD24E12000-memory.dmp
memory/996-4-0x00007FFD24E00000-0x00007FFD24E02000-memory.dmp
memory/996-3-0x00007FFD260C0000-0x00007FFD260C2000-memory.dmp
memory/996-2-0x00007FFD260B0000-0x00007FFD260B2000-memory.dmp
memory/996-1-0x00007FFD26FC0000-0x00007FFD26FC2000-memory.dmp
memory/996-0-0x00007FFD26FB0000-0x00007FFD26FB2000-memory.dmp
memory/996-8-0x0000000140000000-0x000000014212C000-memory.dmp
memory/996-12-0x0000000140000000-0x000000014212C000-memory.dmp
memory/996-13-0x0000000140217000-0x00000001410B3000-memory.dmp
memory/996-14-0x0000000140000000-0x000000014212C000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-26 02:38
Reported
2024-05-26 02:41
Platform
win7-20240508-en
Max time kernel
118s
Max time network
120s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2244 wrote to memory of 2632 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe |
| PID 2244 wrote to memory of 2632 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe |
| PID 2244 wrote to memory of 2632 | N/A | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe | C:\Users\Admin\AppData\Local\Temp\Karma\main.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Karma\main.exe
"C:\Users\Admin\AppData\Local\Temp\Karma\main.exe"
C:\Users\Admin\AppData\Local\Temp\Karma\main.exe
"C:\Users\Admin\AppData\Local\Temp\Karma\main.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI22442\ucrtbase.dll
| MD5 | b0397bb83c9d579224e464eebf40a090 |
| SHA1 | 81efdfe57225dfe581aafb930347535f08f2f4ce |
| SHA256 | d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66 |
| SHA512 | e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 9d8e7a90dd0d54b7ccde435b977ee46d |
| SHA1 | 15cd12089c63f4147648856b16193cf014e6764f |
| SHA256 | dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6 |
| SHA512 | 339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | d399c926466f044f183faa723ba59120 |
| SHA1 | a9534b4910888d70eefba6fcc3376f2549cb4a05 |
| SHA256 | 19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1 |
| SHA512 | fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-file-l1-2-0.dll
| MD5 | b59d773b0848785a76baba82d3f775fa |
| SHA1 | 1b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82 |
| SHA256 | 0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0 |
| SHA512 | cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26 |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-file-l2-1-0.dll
| MD5 | 4c9bf992ae40c7460a029b1046a7fb5e |
| SHA1 | 79e13947af1d603c964cce3b225306cadff4058b |
| SHA256 | 18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4 |
| SHA512 | c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8 |
\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | ea5f768b9a1664884ae4ae62cec90678 |
| SHA1 | ae08e80431da7f4e8f1e5457c255cc360ef1cac0 |
| SHA256 | 24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d |
| SHA512 | 411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c |
C:\Users\Admin\AppData\Local\Temp\_MEI22442\python39.dll
| MD5 | 2135da9f78a8ef80850fa582df2c7239 |
| SHA1 | aac6ad3054de6566851cae75215bdeda607821c4 |
| SHA256 | 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3 |
| SHA512 | 423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369 |