56fd07483550ff364725fa4d1d704e0d0d46e21a3ca8b3744d5ce0e2f5638e4e

General

Target

41521fd54fe2b33bb7e5fa73c170c660N.exe
Size

94KB
MD5

41521fd54fe2b33bb7e5fa73c170c660
SHA1

fccb2857d49437eec068f86c6ee60e260c3de2c6
SHA256

56fd07483550ff364725fa4d1d704e0d0d46e21a3ca8b3744d5ce0e2f5638e4e
SHA512

4f70e625008b04150655ffe35a77e16fc6da12547a298a86ecd6dcd990896071b319faa001acfb63fd19e367ccb378ce3f5027505d9923a46b93f7bb5f04c142
SSDEEP

1536:FQ2lT0Q4OgsMMraZ/cc55k/rUhzCpn2LoS5DUHRbPa9b6i+sImo71+jqx:FrOOUdZ1DkohzKMoS5DSCopsIm81+jqx

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjihalag.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjihalag.exe

Executes dropped EXE 2 IoCs

pid	Process
1800	Kjihalag.exe
1696	Klhemhpk.exe

Loads dropped DLL 8 IoCs

pid	Process
3060	41521fd54fe2b33bb7e5fa73c170c660N.exe
3060	41521fd54fe2b33bb7e5fa73c170c660N.exe
1800	Kjihalag.exe
1800	Kjihalag.exe
2488	WerFault.exe
2488	WerFault.exe
2488	WerFault.exe
2488	WerFault.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kjihalag.exe	41521fd54fe2b33bb7e5fa73c170c660N.exe
File opened for modification	C:\Windows\SysWOW64\Kjihalag.exe	41521fd54fe2b33bb7e5fa73c170c660N.exe
File created	C:\Windows\SysWOW64\Hqbbglbj.dll	41521fd54fe2b33bb7e5fa73c170c660N.exe
File created	C:\Windows\SysWOW64\Klhemhpk.exe	Kjihalag.exe
File opened for modification	C:\Windows\SysWOW64\Klhemhpk.exe	Kjihalag.exe
File created	C:\Windows\SysWOW64\Ldpeabpb.dll	Kjihalag.exe

Program crash 1 IoCs

pid	pid_target	Process
2488	1696	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjihalag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klhemhpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41521fd54fe2b33bb7e5fa73c170c660N.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjihalag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldpeabpb.dll"	Kjihalag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	41521fd54fe2b33bb7e5fa73c170c660N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjihalag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	41521fd54fe2b33bb7e5fa73c170c660N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqbbglbj.dll"	41521fd54fe2b33bb7e5fa73c170c660N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1800	3060	41521fd54fe2b33bb7e5fa73c170c660N.exe	30
PID 3060 wrote to memory of 1800	3060	41521fd54fe2b33bb7e5fa73c170c660N.exe	30
PID 3060 wrote to memory of 1800	3060	41521fd54fe2b33bb7e5fa73c170c660N.exe	30
PID 3060 wrote to memory of 1800	3060	41521fd54fe2b33bb7e5fa73c170c660N.exe	30
PID 1800 wrote to memory of 1696	1800	Kjihalag.exe	31
PID 1800 wrote to memory of 1696	1800	Kjihalag.exe	31
PID 1800 wrote to memory of 1696	1800	Kjihalag.exe	31
PID 1800 wrote to memory of 1696	1800	Kjihalag.exe	31
PID 1696 wrote to memory of 2488	1696	Klhemhpk.exe	32
PID 1696 wrote to memory of 2488	1696	Klhemhpk.exe	32
PID 1696 wrote to memory of 2488	1696	Klhemhpk.exe	32
PID 1696 wrote to memory of 2488	1696	Klhemhpk.exe	32

C:\Users\Admin\AppData\Local\Temp\41521fd54fe2b33bb7e5fa73c170c660N.exe
"C:\Users\Admin\AppData\Local\Temp\41521fd54fe2b33bb7e5fa73c170c660N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\Kjihalag.exe
  C:\Windows\system32\Kjihalag.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\Klhemhpk.exe
    C:\Windows\system32\Klhemhpk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 140
      4⤵
      Loads dropped DLL
      Program crash
      PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Klhemhpk.exe

Filesize
94KB

MD5
04ec22301be6616191683c1702ecc32a

SHA1
0d1d94c8aec9ea40c0efafb4f11fb6fff502bcd9

SHA256
99e528e9bb1c0e9d794698e2420e382d49eeac03a4f460c00bf649c6641688fa

SHA512
e9d96b321f55d42b4c425365cf52944017fa07263c76969ec874239349363f73384398ffa03a229ca651e5d4acda4d65bf673b9d7dd1e906e1a390f8cbe5ef4f

Download Submit
\Windows\SysWOW64\Kjihalag.exe

Filesize
94KB

MD5
6ff584c5942b568dfb366506f7db91cc

SHA1
5b83f3fb81bb0b6a1dd8f8de3d5edda2ef4b1a9b

SHA256
b96514b9f230c696ff3c788bf061c9dc667e4ca5da43e1ded1c04d9518e566ab

SHA512
f55b1670c06d8a1df40b2ea5b3e51503d9829ea45911594eff9b9100db7c9aac442e4bacee3471c49c68d40da1f2a8e3e81b4aeb4562d430debb336306347293

Download Submit
memory/1696-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1800-19-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1800-21-0x0000000000260000-0x000000000029E000-memory.dmp

Filesize
248KB

Download
memory/3060-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3060-17-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download
memory/3060-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads