Analysis
-
max time kernel
55s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
Bunifu_UI_v1.5.3.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Kidd.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Kidd.exe
Resource
win10v2004-20241007-en
General
-
Target
Kidd.exe
-
Size
2.6MB
-
MD5
0c1445834ed4f5a70b5e509012bcb693
-
SHA1
917dca222a871b27845768caa725bf67dbd04ef7
-
SHA256
c7ac902058cdc9dc40e5219ee2e4aa0530d176e7d7f0b034c1131636e4383131
-
SHA512
b39a6387670ffcb3cfbe7eed0b52defbd8d2b8660492a73685f5492b815dc50e57c5e56efdd5aceac50ff0e87e13d603e4bb6c526660f2f2b633210cc5fe66ce
-
SSDEEP
49152:+oBdC7r6Kxbt+6epx1FZtNNntJnRJ7lzT8oo6FxPiOPZp3Rtz:RBA6x1jDhvnzlroI1bBt
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe 4160 Kidd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4160 Kidd.exe