Analysis
-
max time kernel
112s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 04:21
Behavioral task
behavioral1
Sample
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe
Resource
win10v2004-20241007-en
General
-
Target
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe
-
Size
37KB
-
MD5
8a2c4dfca2c807e0038832937b506380
-
SHA1
6d55e67061809c42b9d0a6f86687aa40fe048777
-
SHA256
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761
-
SHA512
62cb76464c71b1a97e196fda016885722cefd61a206e6455318f20155c9b78b27a605a307d03feaf30677a58f789217e299274d5bf0d3e02ddbed0d94e9c810f
-
SSDEEP
768:AnoSEjp9Plchfr6TUqnbcuyD7UYK41lll/J0ppppCwwwcooodwwwt111q1YYYU/T:AoSEZWTUUqnouy8YX/vooodwwwt111+p
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2044 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 952 kkehost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/files/0x000c00000001225c-3.dat upx behavioral1/memory/2344-5-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/952-6-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/952-12-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/952-15-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\kkehost.exe a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe File opened for modification C:\Windows\Debug\kkehost.exe a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kkehost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 kkehost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz kkehost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2344 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2044 2344 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 30 PID 2344 wrote to memory of 2044 2344 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 30 PID 2344 wrote to memory of 2044 2344 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 30 PID 2344 wrote to memory of 2044 2344 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe"C:\Users\Admin\AppData\Local\Temp\a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A2D97B~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2044
-
-
C:\Windows\Debug\kkehost.exeC:\Windows\Debug\kkehost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD540221fae29e6eb2e38ee3e3482033369
SHA180cc6c56e65d76ca6a9fd3cb80cb975ded37cd1f
SHA256cd53f562751e618494293b00ce68a2beae15131e8764fefbd8bfcc7678eaee0c
SHA51287623926d5a3c26bd454f710669dc3c09908e7893daab7ca94badbdc4b1b98d993340a95249fb68afe3c8ba5ab6140227e57116770c3b84e8ec582e05e9b1190