2ceb025a3125915e904bc8861933f6d33960a5ad6c4c880c4ac89788253e6132

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoKuai.exe
Size

1.2MB
MD5

240c9efcd0f922441867ca8d74393404
SHA1

83a3bf0aaad0c5f5708839e08d3f85db09106da0
SHA256

50645a3f7d709269fc22f1e1f27203ebb1b75551a251442b2189b71cc4f039c2
SHA512

30c7609dc64778fc257a8455d68ad1619f1149a7b088af11ed7b256eb15c484b474154f8033e910fd828c0cd7b0ca37ae1522768e7db3ee9153cb02a8970919b
SSDEEP

24576:U5pd8sAT/whnGsv9ZR/d879exaIJKmLKjULpZ2XHxWow2bSzGpVf2hQpUOuLT0oW:upd8sADwhnGsv9ZR/d87oxnKSKjKU3kY

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\CreateDriver = 01000000	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\RigthMenu = 01000000	GoKuai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoKuai = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoKuai.exe mini"	GoKuai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserName	GoKuai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\PassWord	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Time = 01000000	GoKuai.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\First = 01000000	GoKuai.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoKuai.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentPort = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentUseUser = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Scandisk = 02000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\CurrentPath	GoKuai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Message = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Recevies = 02000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\MessageContent	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Agent = 00000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentIP	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentPassword	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\ = "{AEB6F97A-A60D-4B21-9D3C-687E490F227D}"	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\Log = 00000000	GoKuai.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\NetType = 00000000	GoKuai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GoKuai\AgentUser	GoKuai.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe
2976	GoKuai.exe

C:\Users\Admin\AppData\Local\Temp\GoKuai.exe
"C:\Users\Admin\AppData\Local\Temp\GoKuai.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2976