Overview
overview
8Static
static
3KospArsivi...nt.exe
windows7-x64
7KospArsivi...nt.exe
windows10-2004-x64
7KospArsivi...om.exe
windows7-x64
7KospArsivi...om.exe
windows10-2004-x64
7procexp.chm
windows7-x64
1procexp.chm
windows10-2004-x64
1procexp.exe
windows7-x64
8procexp.exe
windows10-2004-x64
8KospArsivi...t1.exe
windows7-x64
7KospArsivi...t1.exe
windows10-2004-x64
7KospArsivi...or.exe
windows7-x64
7KospArsivi...or.exe
windows10-2004-x64
7KospArsivi...t8.dll
windows7-x64
3KospArsivi...t8.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
KospArsivi_seriMinor_Combo_MultiKo_/1733 Multi Client/MultiClient.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
KospArsivi_seriMinor_Combo_MultiKo_/1733 Multi Client/MultiClient.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
KospArsivi_seriMinor_Combo_MultiKo_/Game Hacker v1733/Koxp Frmstar.com.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
KospArsivi_seriMinor_Combo_MultiKo_/Game Hacker v1733/Koxp Frmstar.com.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
procexp.chm
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
procexp.chm
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
procexp.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
procexp.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
KospArsivi_seriMinor_Combo_MultiKo_/Kobot 1733/Project1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
KospArsivi_seriMinor_Combo_MultiKo_/Kobot 1733/Project1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/Seri Minor.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/Seri Minor.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/dinput8.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/dinput8.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
procexp.exe
-
Size
3.4MB
-
MD5
3c0b27e96a095d9d4494ef9e531c1e45
-
SHA1
66d089c0494fbc0a0ca1c26f97e2d5b4cfa68494
-
SHA256
47cbfc097662709c6ef5f83ab1809b4036ea2f7d02ff4c5435dea4b36c36e937
-
SHA512
a9260cb523ed02ea0f44ea7c44ac6f4ebc6592bcf68d3045b5bb2a0ef7b0ec323cfee6306f077377ecdbf2d28372ec1ba78a341a13c6b49c53ef778556e39ccc
-
SSDEEP
24576:7Cgbb/cmQ8mT355OJ11DqC340V8dq8ZDuQItBV9kTbcDeuAe2te67lRzCK1ObQ49:L25g1t40eIHV8bcDs/hROBf5n
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP113.SYS procexp64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP113\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP113.SYS" procexp64.exe -
Executes dropped EXE 1 IoCs
pid Process 2344 procexp64.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\V: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\Y: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\R: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\T: procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\E: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\S: procexp64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procexp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2344 procexp64.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2344 procexp64.exe Token: SeBackupPrivilege 2344 procexp64.exe Token: SeSecurityPrivilege 2344 procexp64.exe Token: SeLoadDriverPrivilege 2344 procexp64.exe Token: SeShutdownPrivilege 2344 procexp64.exe Token: SeCreatePagefilePrivilege 2344 procexp64.exe Token: SeShutdownPrivilege 2344 procexp64.exe Token: SeCreatePagefilePrivilege 2344 procexp64.exe Token: SeDebugPrivilege 2344 procexp64.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe 2344 procexp64.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4460 wrote to memory of 2344 4460 procexp.exe 85 PID 4460 wrote to memory of 2344 4460 procexp.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp.exe"C:\Users\Admin\AppData\Local\Temp\procexp.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\AppData\Local\Temp\procexp.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
859KB
MD57a31ef490116d2863ae9ff2325df5dbd
SHA10cbb4dd4861af50e678db3882175b42b2877d65c
SHA256827cf0e256c453eb5b3b39387e7b18aff1f62af4d4584da06d8e94f030ea5468
SHA5127c051906f7ea335b072ceab41fc7f366c5ee20bc13e9038c8efc156cec320b329a306be01512e383a57ca918a83fff514c918918f521a0a620f810d827b09751