Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 20:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KMTClientv3.0.exe
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
KMTClientv3.0.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target KMTClientv3.0.exe
- Size 6.9MB
- Sample240613-ytabdstamj
- SHA256 8af5764d7c290234e14ed008875cb1cfbc35e4c2ef7526bdc3645e66c7681667
- MD5 eb561ddc1ca202e3a6d7ab3a9d4fbb5c
- SHA1 e9edf44a0960c1382f5f9294326ee7f6b4d55bf1
- SHA512 9bc19395ad00b3fd71c7ccfadd0009df0c781df935db138a98bf02d707b8450ab2c005fc7aa6aef96d20831caa9bb733bfc74e89bf903e6481cd94305388210d
- SSDEEP 196608:02zVozSypuz890aOjf1fS5qjjC4NKMTs7o:FzVGvE+0aQf1eeLKt7o
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2448 KMTClientv3.0.exe 2728 KMTClientv3.0.exe - Loads dropped DLL 1 IoCs
pid Process 2728 KMTClientv3.0.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\sechost.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\clbcatq.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\MSCTF.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\KERNEL32.DLL KMTClientv3.0.exe File opened for modification C:\Windows\System32\GDI32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\gdi32full.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\ole32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\shcore.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\ws2_32.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\user32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\msvcrt.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll KMTClientv3.0.exe File opened for modification C:\Windows\system32\shfolder.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\win32u.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\comdlg32.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll KMTClientv3.0.exe File opened for modification C:\Windows\system32\IconCodecService.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\WindowsCodecs.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\bcrypt.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\oleaut32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\msvcp_win.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\combase.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\imm32.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\uxtheme.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\advapi32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\shell32.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\shlwapi.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\psapi.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\Wldp.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\profapi.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\KERNELBASE.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\ucrtbase.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\RPCRT4.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll KMTClientv3.0.exe File opened for modification C:\Windows\system32\explorerframe.dll KMTClientv3.0.exe File opened for modification C:\Windows\System32\imagehlp.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\version.dll KMTClientv3.0.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll KMTClientv3.0.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll KMTClientv3.0.exe - Modifies registry class 4 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\specСheck\private\PrivateKey2 = 33344237 KMTClientv3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\specСheck\private KMTClientv3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\specСheck KMTClientv3.0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\specСheck\private\PrivateKey3 = 46384339 KMTClientv3.0.exe - Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 KerroX Engine : luascript HTTP User-Agent header 24 KerroX Engine : luascript HTTP User-Agent header 26 KerroX Engine : luascript HTTP User-Agent header 35 KerroX Engine : luascript HTTP User-Agent header 38 KerroX Engine : luascript - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2728 KMTClientv3.0.exe Token: SeTcbPrivilege 2728 KMTClientv3.0.exe Token: SeTcbPrivilege 2728 KMTClientv3.0.exe Token: SeLoadDriverPrivilege 2728 KMTClientv3.0.exe Token: SeCreateGlobalPrivilege 2728 KMTClientv3.0.exe Token: SeLockMemoryPrivilege 2728 KMTClientv3.0.exe Token: 33 2728 KMTClientv3.0.exe Token: SeSecurityPrivilege 2728 KMTClientv3.0.exe Token: SeTakeOwnershipPrivilege 2728 KMTClientv3.0.exe Token: SeManageVolumePrivilege 2728 KMTClientv3.0.exe Token: SeBackupPrivilege 2728 KMTClientv3.0.exe Token: SeCreatePagefilePrivilege 2728 KMTClientv3.0.exe Token: SeShutdownPrivilege 2728 KMTClientv3.0.exe Token: SeRestorePrivilege 2728 KMTClientv3.0.exe Token: 33 2728 KMTClientv3.0.exe Token: SeIncBasePriorityPrivilege 2728 KMTClientv3.0.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2728 KMTClientv3.0.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2448 2020 KMTClientv3.0.exe 82 PID 2020 wrote to memory of 2448 2020 KMTClientv3.0.exe 82 PID 2020 wrote to memory of 2448 2020 KMTClientv3.0.exe 82 PID 2448 wrote to memory of 2728 2448 KMTClientv3.0.exe 84 PID 2448 wrote to memory of 2728 2448 KMTClientv3.0.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\KMTClientv3.0.exe"C:\Users\Admin\AppData\Local\Temp\KMTClientv3.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\KMTClientv3.0.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\KMTClientv3.0.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\KMTClientv3.0.exeC:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\KMTClientv3.0.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2728
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\CET_Archive.dat
- Size 6.6MB
- SHA256 6f9d05a727eec025d66c5df38409324e77b76644faea50a6b0ca958ed3f6ebdf
- MD5 f6a34840e0c5d7cfb2afb673c7dcc4ee
- SHA1 c7160f6d4439c14f0fc11db2d4f2d0c618e928c2
- SHA512 88344660a23c10978eb54a1002d95483eb3fc7aba260e95a5bd7cc994be25552b9455656818605f9022942130f4646e0fdecd777fcb449a054d6336e657808cc
- SSDEEP 196608:S2zVozSypuz890aOjf1fS5qjjC4NKMTs7d:TzVGvE+0aQf1eeLKt7d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\KMTClientv3.0.exe
- Size 189KB
- SHA256 dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
- MD5 a65c29111a4cf5a7fdd5a9d79f77bcab
- SHA1 c0c59b1f792c975558c33a3b7cf0d94adc636660
- SHA512 b37ef3351e8f46f7183550254acce99b54e0199fc37a02cca78b471dc2d8b697769afdaf7e6cfe89422cfed65a8dcc6d158ef52aba5b0ac9350ea05607fefd7f
- SSDEEP 3072:/bpNXPzitxNyVg64pEIP9lz3mjoOejfyyswe710LJNEXvXO29s6l8Bji1u78xb/1:/1NXPQNyVg64p5P9lz33OezRswe710Ll
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\CET_TRAINER.CETRAINER
- Size 312KB
- SHA256 e64c8086d4cb3a85ee7f9653e95ec0d4e875a46549a2552dd493fea8be0c44e5
- MD5 10d093e6640389817997cbb34a7f734e
- SHA1 dc3d219d1f087f2958fbb0e382cc7b26271d1534
- SHA512 c6d9b9445f80dcdb6eb3dccd12463297b4ad4fb31adf9f422aaf11de8bdecd5db7963eb9419e9728b1392b0e7bc7ea253c6a8812338533718f17cf2206e0e8ef
- SSDEEP 6144:RvX4fRaEohzTKANRSZ4oR5Ozz9lIpxj3AW2OaJfKlIXvg1AsjtOiVbAADm0Qcir:RvX4QEJGvBzqtwTO9IQombvnQZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\KMTClientv3.0.exe
- Size 14.7MB
- SHA256 a104764c31601fdb53eba710140a59a44869766016e93e3dcf728e1bfe467ddf
- MD5 654fb43d9ddf9692e02f615b04e8fa0b
- SHA1 69ae2def044af1eb0795d1401c26ca4fd62c43b6
- SHA512 fe76651969fce6494f0a82290f66fd02bbba2ea28d22853e602071817f3ed17ff977b6f878e0d2daad224a77e4c2edd525a72de9e4235c1d82ea6fb92c54d97d
- SSDEEP 196608:vQR/RfN7+KSAowbqjw7EdbCLWRCH1ayTTk11CXZ0:vQR/RfN7+KSAzbqj1dbCyEHDnKCXZ0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\autorun\luasymbols.lua
- Size 629B
- SHA256 c5a35380af8bebe96b85377f5f41f8c068cb857c74b9cb85b7467b35c1de10c4
- MD5 df4d243ab0407a1f03ccf448232fcf62
- SHA1 62453cfa7abf6fa83158be1ba86c854d9a6b7d4b
- SHA512 4b05b65909673e92f59ab64c1ff4e0b829f5c9085eafa1fff28cb0ccd7e6a7f6ef031633f443e0ba156a4b8f5009f526d0356f39ef77b22706f98f100b1909c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\autorun\monoscript.lua
- Size 125KB
- SHA256 46a3618d096ccaca664c0c91e19c7495f7128dc2537c484d95e13439e60c8e22
- MD5 c79cc4cf9220f7c71eeec42410cf9742
- SHA1 100cc283890b5aa031a75387efa596561d83ec64
- SHA512 f55968468c882ca3efb731c0bbdc1d39c9b13431f8b1f7b463f1c619b67725093546a6af2b2ed889bf08d76ce4ac7cd1dc5677e89140512e29fef37711b1dccd
- SSDEEP 768:bjmxQLPqWuiXL9eoiK8uthP/xoiEFLWiP8bTg1b3lDWIkfkxv0C2r0EcD+JZHaDe:Ho5xU+1GiOLXfJ2Ybo6FG7236nD2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\defines.lua
- Size 11KB
- SHA256 30b816a90abbe520bcb6606d022f3c870a72ad05a94522ff64b8395bfc088e67
- MD5 50ddb39ece0aabd0e709adfc15f93ce2
- SHA1 56398bc80ff7235fd429b0ba557e0681fbdab7a6
- SHA512 36fabd7f88f8895f2561d5983a6243781ddefea711d9905a0870daa24f95928ea4af72258e7c842f9c4df9dd2553ef9b67a4f5cdc1f3a75e54cd38070465c66c
- SSDEEP 192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9qh07EBS5perFrLUK80u9E3:AHuderlSZk/8FtIF4umMqEpCg3fS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET5D33.tmp\extracted\lua53-64.dll
- Size 528KB
- SHA256 6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff
- MD5 b7c9f1e7e640f1a034be84af86970d45
- SHA1 f795dc3d781b9578a96c92658b9f95806fc9bdde
- SHA512 da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3
- SSDEEP 6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV
- MD5 SHA1 SHA512 SSDEEP