Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 16:53
Static task
static1
Behavioral task
behavioral1
Sample
Bunifu_UI_v1.5.3.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Kidd.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Kidd.exe
Resource
win10v2004-20241007-en
General
-
Target
Kidd.exe
-
Size
2.6MB
-
MD5
0c1445834ed4f5a70b5e509012bcb693
-
SHA1
917dca222a871b27845768caa725bf67dbd04ef7
-
SHA256
c7ac902058cdc9dc40e5219ee2e4aa0530d176e7d7f0b034c1131636e4383131
-
SHA512
b39a6387670ffcb3cfbe7eed0b52defbd8d2b8660492a73685f5492b815dc50e57c5e56efdd5aceac50ff0e87e13d603e4bb6c526660f2f2b633210cc5fe66ce
-
SSDEEP
49152:+oBdC7r6Kxbt+6epx1FZtNNntJnRJ7lzT8oo6FxPiOPZp3Rtz:RBA6x1jDhvnzlroI1bBt
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe 2428 Kidd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2428 Kidd.exe