Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
causativenesszb.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
General
-
Target
causativenesszb.exe
-
Size
181KB
-
MD5
0d9f4b56d3f36373f8bf26e8107100b0
-
SHA1
8516094991d5fe0a4c2cec90e9f54833f1d0a326
-
SHA256
a6b5435b16903b2c557210a813fdfacc9d4b965d01b05a46a3d2b6c353719e05
-
SHA512
a313b0219d5248f9995f3b2f70bf30e8e9cf528659e98a4cb53b3ffdc80d1b0c9ee03cc3bc6d3bed36d31801506200a1188c849f551d401b725bd009f6e91c20
-
SSDEEP
3072:3CmlA+2TGMF85+bkRG32foUP9GmPe97UoSs1urv9zHKipsK/huffqeNntqpKRnHV:SmlV4h8JG3QUzSOwzH6K/hC9tqp6HhNZ
Malware Config
Extracted
Family
koiloader
C2
http://195.123.224.66/marasmus.php
Attributes
-
payload_url
https://www.dsestimation.com/wp-content/uploads/2015/10
Signatures
-
Detects KoiLoader payload 1 IoCs
resource yara_rule behavioral2/memory/2836-0-0x0000000002550000-0x000000000255D000-memory.dmp family_koi_loader -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3292 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3292 taskmgr.exe Token: SeSystemProfilePrivilege 3292 taskmgr.exe Token: SeCreateGlobalPrivilege 3292 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe 3292 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\causativenesszb.exe"C:\Users\Admin\AppData\Local\Temp\causativenesszb.exe"1⤵PID:2836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3292