030a17891ab814bdb6a92285a0c92443b5cf797551c3346dc98a4fd65d856d24

General

Target

2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe
Size

10.2MB
MD5

ad704f4d50d21e895c9cfcb8d78afdc6
SHA1

28cf5bad8f3bc495be1f966238289556de59fc05
SHA256

030a17891ab814bdb6a92285a0c92443b5cf797551c3346dc98a4fd65d856d24
SHA512

046ba78deafbe60ab87a0014a8ae5c32ae0a49df873ae899a96aaa634708591dd280600e1649ebd3159003821f337fc1cdae894bde8add3baca7f4d40a54f146
SSDEEP

196608:GwfrvAXkRHbisSjRjnV9RB6PAx0WZHCWYSl/95DW:xrdR7IRjn3uODNnPhW

Score

7^/10

discovery persistence themida

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe

Executes dropped EXE 1 IoCs

pid	Process
3636	Payload.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x003c000000023442-11.dat	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe"	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe
Token: 33	3636	Payload.exe
Token: SeIncBasePriorityPrivilege	3636	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3636	3660	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe	95
PID 3660 wrote to memory of 3636	3660	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe	95
PID 3660 wrote to memory of 3636	3660	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe	95
PID 3660 wrote to memory of 1580	3660	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe	96
PID 3660 wrote to memory of 1580	3660	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe	96
PID 3660 wrote to memory of 1580	3660	2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1580	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Payload.exe

Filesize
10.2MB

MD5
ad704f4d50d21e895c9cfcb8d78afdc6

SHA1
28cf5bad8f3bc495be1f966238289556de59fc05

SHA256
030a17891ab814bdb6a92285a0c92443b5cf797551c3346dc98a4fd65d856d24

SHA512
046ba78deafbe60ab87a0014a8ae5c32ae0a49df873ae899a96aaa634708591dd280600e1649ebd3159003821f337fc1cdae894bde8add3baca7f4d40a54f146

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

Filesize
1KB

MD5
933490161b0b59c49a01b612b65e7911

SHA1
b14f486248cef2a24f2b97a17eb0e41a5eef1b19

SHA256
e762e2c786953a74b5bc9d033dd7079d461878ce5daab7553ef3e9a167c4a616

SHA512
18f70920bac4f24d2a28e3698066e6dd43af8095a56a572426eaf9f3a5d9ec191417ec65ff608fc4e882629a5bc78eb0a25f818d5a7e193e9b304c8ad93ee74d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

Filesize
1KB

MD5
965e6302945bcceb865364e8b236e877

SHA1
93fa7c16c468a8c51abd8fee2aac5cbd86b4762f

SHA256
f7f347cf948f21b405726e3773883de988de72b41e954943cc9b4c8af53e45b5

SHA512
beddca6ae7c5d09f03de7fa716529d0a349d7b377b2e0a3d8689c07fe2b30335814f7e8d631c61823aec23b4b71be2f73e1589e7fde82818dcb454fe6c845cf6

Download Submit
memory/3636-17-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3636-24-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3636-19-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3636-16-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3660-5-0x00000000746A2000-0x00000000746A3000-memory.dmp

Filesize
4KB

Download
memory/3660-6-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3660-18-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3660-0-0x00000000746A2000-0x00000000746A3000-memory.dmp

Filesize
4KB

Download
memory/3660-2-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download
memory/3660-1-0x00000000746A0000-0x0000000074C51000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads