Overview

overview

8

Static

static

3

koid.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    koid.exe

  • Size

    1.7MB

  • Sample

    240619-n8l9dszejg

  • MD5

    937bd53a5f505b8e9b00416590ad8d92

  • SHA1

    5abece11f9d282ec009bf441f132676344f1ede2

  • SHA256

    662d56478c8fa24fb43b71cba64af8d941ddb90659c2412144b46137e2cc4c36

  • SHA512

    2027fe14eff8cc0edd67be7f159e0710d79376aef11a70d4c0ad94d501667fd178780fb3a8f0c4481d2da32a3f6fd698e45cef297aee628cda1ae164e0434dd5

  • SSDEEP

    49152:MXi87ZaoNcK9mVrSPYO1M+BrgdhwmzJnU:yvycBr

Score
8/10
persistence

Malware Config

Targets

    • Target

      koid.exe

    • Size

      1.7MB

    • MD5

      937bd53a5f505b8e9b00416590ad8d92

    • SHA1

      5abece11f9d282ec009bf441f132676344f1ede2

    • SHA256

      662d56478c8fa24fb43b71cba64af8d941ddb90659c2412144b46137e2cc4c36

    • SHA512

      2027fe14eff8cc0edd67be7f159e0710d79376aef11a70d4c0ad94d501667fd178780fb3a8f0c4481d2da32a3f6fd698e45cef297aee628cda1ae164e0434dd5

    • SSDEEP

      49152:MXi87ZaoNcK9mVrSPYO1M+BrgdhwmzJnU:yvycBr

    Score
    8/10
    persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks