Overview
overview
3Static
static
31860 KingK....5.exe
windows7-x64
31860 KingK....5.exe
windows10-2004-x64
31860 KingK...nt.dll
windows7-x64
31860 KingK...nt.dll
windows10-2004-x64
31860 KingK...3N.dll
windows7-x64
31860 KingK...3N.dll
windows10-2004-x64
31860 KingK...IM.dll
windows7-x64
31860 KingK...IM.dll
windows10-2004-x64
31860 KingK...32.dll
windows7-x64
31860 KingK...32.dll
windows10-2004-x64
31860 KingK...t8.dll
windows7-x64
31860 KingK...t8.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1860 KingKoxp Süper Macro v1.5/1860 KingKoxp Süper Macro v1.5.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1860 KingKoxp Süper Macro v1.5/1860 KingKoxp Süper Macro v1.5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
1860 KingKoxp Süper Macro v1.5/MultiClient.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
1860 KingKoxp Süper Macro v1.5/MultiClient.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
1860 KingKoxp Süper Macro v1.5/TABCTL3N.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
1860 KingKoxp Süper Macro v1.5/TABCTL3N.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
1860 KingKoxp Süper Macro v1.5/TASARIM.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
1860 KingKoxp Süper Macro v1.5/TASARIM.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
1860 KingKoxp Süper Macro v1.5/comdlg32.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
1860 KingKoxp Süper Macro v1.5/comdlg32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
1860 KingKoxp Süper Macro v1.5/dinput8.dll
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
1860 KingKoxp Süper Macro v1.5/dinput8.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1860 KingKoxp Süper Macro v1.5/1860 KingKoxp Süper Macro v1.5.exe
-
Size
1.0MB
-
MD5
29a25f6ed61e21f40d9c7d07cba5df1b
-
SHA1
33e4db9ac67a2f76ef54b1ee0373939988960a15
-
SHA256
a0ee68fc2307984bd65df8e05f51f98e3a1ecb1497af2405ee0313d74e3ae1b9
-
SHA512
0cec13983389067b6a26f10d3bbe7a9ffb7ab1be05342b8d2e0e193c0c25856bb234e77c43a00b4d7f2224e6023bcc6b4903e07a168936664db26f5c5786b332
-
SSDEEP
24576:C/AyAAAyAl/AyAAAyAEN/AyAAAyAXdAyAqAyAk:jyMyxyMyIyMyHyoy
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1860 KingKoxp Süper Macro v1.5.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AFDF58C-212E-4AD5-B331-0EC4EFC3289C}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1860KI~1.5\\TASARIM.OCX, 4" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABF09FE5-5942-4154-9899-54CD5F9366FB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1860KI~1.5\\TASARIM.OCX" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9000F023-90D0-498F-B294-35228455B1FA}\InprocServer32\ThreadingModel = "Apartment" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73D1B7ED-51FB-432B-BBBA-521586919041}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0379F6F-AB5E-4C8E-97A7-E02F99ACDA71}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CB2F496-5E7D-43C1-B9B7-8B082F07A2B1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85BCF7E0-7D0E-4ED1-A715-B2255708D4BC}\ = "Xtreme ProgressBar Control" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9190DF72-E9C2-44FA-85C4-C0320F13ACCC}\Version 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB12B084-73D8-4ADF-8EFA-CB2757CA1C22}\ = "_DProgressBar" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.ScrollBar.13.4.0\ = "Xtreme ScrollBar Control" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCC528A8-9479-48D5-A14D-077A9FD5D276} 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C166B43C-7947-49C7-B61B-4F703F1D54C9} 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9190DF72-E9C2-44FA-85C4-C0320F13ACCC}\InprocServer32\ThreadingModel = "Apartment" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F49A42B-A7AE-4D58-B43E-A1F331280756}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1860KI~1.5\\TASARIM.OCX" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5557BE9B-8784-4B18-976D-F889C1F8B1E9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{985878EB-DF8B-492C-8223-1516F05931A2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{928BF702-1A5D-4809-9C96-FF9B8B460815}\TypeLib 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5565415F-34DA-45A7-81DA-735C5AE80BBE}\ToolboxBitmap32 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28A1CBE6-4B44-4BEE-A7A8-8F5954390D95}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9D0D8FA7-C2DC-4C83-8840-879B3C33E6BD}\ = "_DTabControlEvents" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46DFCA21-B44C-4A46-A55B-07511A1F4717}\ = "ListViewColumnHeader" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31F0A4FD-A258-4B96-92D8-E2A72F89C183}\Control 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E168195-278C-4AA5-80E3-3BEAA952DED0}\Control 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73D1B7ED-51FB-432B-BBBA-521586919041}\MiscStatus\1\ = "131473" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCDB9842-AE6D-46A8-BC77-CEE7D5CE9ED7} 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFA1CBE6-4B44-4BEE-A7A8-8F5954390D95} 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CCF5EAE-9731-436F-8D92-C949D200ADA1} 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6B66937-CF42-4D20-AA31-4A441110286D}\ = "_DSlider" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCDB9842-AE6D-46A8-BC77-CEE7D5CE9ED7}\TypeLib 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8EF14566-A03D-4B53-8C43-AA02C1AAFEA9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.ComboBox.13.4.0\ = "Xtreme ComboBox Control" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E168195-278C-4AA5-80E3-3BEAA952DED0}\InprocServer32 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73D1B7ED-51FB-432B-BBBA-521586919041}\ToolboxBitmap32 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D9CA89C-4F76-49EB-B5A8-36A3151421CA}\ = "Xtreme ColorPicker Control" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00E032CB-FBBC-40DB-846D-05B2CE330888}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11EDDB69-4BE2-43A3-9D26-3BD2E36FD5CD}\Implemented Categories 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF209378-76C0-44D5-A3C8-983C8F428ECC}\Control 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE7BD35C-459D-4285-9E64-36C01E3659A4}\TypeLib\Version = "d.4" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1F9456A-DFD5-4228-9AA3-993A34D32E3A}\Implemented Categories 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F87BE9B-8784-4B18-976D-F889C1F8B1E9}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EF14566-A03D-4B53-8C43-AA02C1AAFEA9}\TypeLib\Version = "d.4" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8072500-F14C-4903-90FE-C9B9684522DE}\MiscStatus\1\ = "131473" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D9CA89C-4F76-49EB-B5A8-36A3151421CA}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1837751-7F27-46D2-91A1-0442FD6DA0DD}\ProxyStubClsid32 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.ScrollBar.13.4.0\CLSID\ = "{C1F9456A-DFD5-4228-9AA3-993A34D32E3A}" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0AE5A41-0B8A-4298-8396-81F0F31326CB} 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{336E7571-FE03-440B-8722-1A1D781EC160}\MiscStatus\ = "0" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21F06C53-8011-44D4-B0AD-F19A5DEB1048}\InprocServer32\ThreadingModel = "Apartment" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5012C11-D6F7-4A60-BC80-6B4D58112A97}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E805BE3-FAF9-4CE9-978C-17E58F2C046D}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF209378-76C0-44D5-A3C8-983C8F428ECC}\InprocServer32 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31520377-A3C5-4E57-85BB-5D2CE5E55A81}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1860KI~1.5\\TASARIM.OCX, 22" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7CC1CC3-EF36-4585-941C-9FCC90A153B1}\ = "_DHexEditEvents" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1F9456A-DFD5-4228-9AA3-993A34D32E3A}\Control 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9190DF72-E9C2-44FA-85C4-C0320F13ACCC}\InprocServer32 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73D1B7ED-51FB-432B-BBBA-521586919041} 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CDB9842-AE6D-46A8-BC77-CEE7D5CE9ED7}\ = "ImageManagerIcon" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD23520C-D0DC-4E43-8B92-55946D1A8DFE}\TypeLib\Version = "d.4" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B92C5C2D-A70B-4266-91CE-4475E8A455B9}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CEB3E6DA-7A7E-43B6-8468-0B74ADBA1168}\TypeLib\Version = "d.4" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.PopupControl.13.4.0 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAC4E8BB-7EFE-4610-8497-10019186A30B}\MiscStatus\ = "0" 1860 KingKoxp Süper Macro v1.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F49A42B-A7AE-4D58-B43E-A1F331280756}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} 1860 KingKoxp Süper Macro v1.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F87BE9B-8784-4B18-976D-F889C1F8B1E9}\TypeLib\Version = "d.4" 1860 KingKoxp Süper Macro v1.5.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2528 1860 KingKoxp Süper Macro v1.5.exe 2528 1860 KingKoxp Süper Macro v1.5.exe 2528 1860 KingKoxp Süper Macro v1.5.exe 2528 1860 KingKoxp Süper Macro v1.5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1860 KingKoxp Süper Macro v1.5\1860 KingKoxp Süper Macro v1.5.exe"C:\Users\Admin\AppData\Local\Temp\1860 KingKoxp Süper Macro v1.5\1860 KingKoxp Süper Macro v1.5.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2528