Overview

overview

8

Static

static

3

Windowkill.zip

windows11-21h2-x64

8

Windowkill...!!.txt

windows11-21h2-x64

3

Windowkill...PC.url

windows11-21h2-x64

1

Windowkill...dk.dll

windows11-21h2-x64

1

Windowkill...ng.dll

windows11-21h2-x64

1

Windowkill...64.dll

windows11-21h2-x64

1

Windowkill...64.dll

windows11-21h2-x64

1

Windowkill...64.dll

windows11-21h2-x64

1

Windowkill...id.txt

windows11-21h2-x64

3

Windowkill...id.txt

windows11-21h2-x64

3

Windowkill...ts.txt

windows11-21h2-x64

3

Windowkill...me.txt

windows11-21h2-x64

3

Windowkill...ge.txt

windows11-21h2-x64

3

Windowkill...rt.txt

windows11-21h2-x64

3

Windowkill...id.txt

windows11-21h2-x64

3

Windowkill...id.txt

windows11-21h2-x64

3

Windowkill...es.txt

windows11-21h2-x64

3

Windowkill...gl.bat

windows11-21h2-x64

1

Windowkill...an.exe

windows11-21h2-x64

1

Windowkill...up.exe

windows11-21h2-x64

7

Windowkill...up.exe

windows11-21h2-x64

7

Windowkill...st.exe

windows11-21h2-x64

6

Windowkill...64.exe

windows11-21h2-x64

7

Windowkill...86.exe

windows11-21h2-x64

7

Windowkill...64.exe

windows11-21h2-x64

7

Windowkill...86.exe

windows11-21h2-x64

7

Windowkill...st.msi

windows11-21h2-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Windowkill.zip
  • Size 90.2MB
  • Sample241106-kzvbvsxdlc
  • SHA256 a9a387482a32f5aeb135b0713ecf60e04680852a0f8f92729e53c837996f1d30
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
steamdefense_evasiondiscoverypersistencephishingprivilege_escalation

Malware Config

Targets

    • Target
      Windowkill.zip
    • Size 90.2MB
    • SHA256 a9a387482a32f5aeb135b0713ecf60e04680852a0f8f92729e53c837996f1d30
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    steamdefense_evasiondiscoverypersistencephishing

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Detected potential entity reuse from brand STEAM.

      phishingsteam
    behavioral1
    • Target
      Windowkill/HOW TO RUN GAME!!.txt
    • Size 299B
    • SHA256 799504fe888155d6c8b73c8d9bc03a9609c1420a1efb74a7b4e158517f3f3936
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral2
    • Target
      Windowkill/STEAMUNLOCKED ยป Free Steam Games Pre-installed for PC.url
    • Size 52B
    • SHA256 677d2e85447eea64fa541b8e8a9e92b41e20456360bef8642f898e7eb1b2f0db
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3
    • Target
      Windowkill/Windowkill/discord_game_sdk.dll
    • Size 3.3MB
    • SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral4
    • Target
      Windowkill/Windowkill/discord_game_sdk_binding.dll
    • Size 401KB
    • SHA256 93113022caba568464712c892815beae865f7caf71443486de9e1ff61d38c065
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      Windowkill/Windowkill/godotsteam.x86_64.dll
    • Size 2.4MB
    • SHA256 994107bd9e54686174da667d839b16d2beef98ae36e65564a7419393d8f807cd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      Windowkill/Windowkill/steam_api64.dll
    • Size 1.9MB
    • SHA256 eb9b78ef3c339591c1993c9c364098de386edd391e1169ea0a6daa39ae9735a9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      Windowkill/Windowkill/steam_api64.dll.bak
    • Size 294KB
    • SHA256 dcfaa13aa419a0641917205957dbe15aa472e7cf09a28cf8d3cf429598e67799
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      Windowkill/Windowkill/steam_appid.txt
    • Size 7B
    • SHA256 71c1d8f9d4a3d1e16d34017ab014190d5274d5cdd6130db362db3d767a77f62d
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral9
    • Target
      Windowkill/Windowkill/steam_settings/build_id.txt
    • Size 8B
    • SHA256 a84c1e1aa5aa46ac7a58c8fe45c4512769e2495f0224a32cec0e3d140492d0e2
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10
    • Target
      Windowkill/Windowkill/steam_settings/depots.txt
    • Size 16B
    • SHA256 94dfd06a3f86b384662d3327f71c268bfbfbd681a4f16c4ece98a2062ed0fdc3
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral11
    • Target
      Windowkill/Windowkill/steam_settings/force_account_name.txt
    • Size 8B
    • SHA256 c575a0aca29870d7a02b83542b457f06efb465aa84f051aedd01087c346c1d0b
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral12
    • Target
      Windowkill/Windowkill/steam_settings/force_language.txt
    • Size 7B
    • SHA256 b6234d2ea0d6022be63db80d7b80e221097fe4a469dc44febcd2a9241effdeba
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral13
    • Target
      Windowkill/Windowkill/steam_settings/force_listen_port.txt
    • Size 5B
    • SHA256 45095e3e3f29ea73ffab2e23158b7cd2afa6532004b5a9b6f06d4e5e068a89aa
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral14
    • Target
      Windowkill/Windowkill/steam_settings/force_steamid.txt
    • Size 17B
    • SHA256 9d135e264c5f017159e5eec06889665766660d38ce1bf8a73db256863f97953b
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral15
    • Target
      Windowkill/Windowkill/steam_settings/steam_appid.txt
    • Size 7B
    • SHA256 71c1d8f9d4a3d1e16d34017ab014190d5274d5cdd6130db362db3d767a77f62d
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral16
    • Target
      Windowkill/Windowkill/steam_settings/supported_languages.txt
    • Size 7B
    • SHA256 b6234d2ea0d6022be63db80d7b80e221097fe4a469dc44febcd2a9241effdeba
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral17
    • Target
      Windowkill/Windowkill/windowkill-opengl.bat
    • Size 48B
    • SHA256 85ceda9964a27ace110aaaa8f98acd07ece65aa2789c3e5b1dbbfba983fe2be7
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral18
    • Target
      Windowkill/Windowkill/windowkill-vulkan.exe
    • Size 81.8MB
    • SHA256 8f9ed1055ed2ed7099d8f03572b1127f7b1f838880b5abeab8a99879439433af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      Windowkill/_Redist/dotNetFx40_Full_setup.exe
    • Size 868KB
    • SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral20
    • Target
      Windowkill/_Redist/dxwebsetup.exe
    • Size 281KB
    • SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral21
    • Target
      Windowkill/_Redist/oalinst.exe
    • Size 790KB
    • SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral22
    • Target
      Windowkill/_Redist/vcredist_2015-2019_x64.exe
    • Size 14.3MB
    • SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral23
    • Target
      Windowkill/_Redist/vcredist_2015-2019_x86.exe
    • Size 13.7MB
    • SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral24
    • Target
      Windowkill/_Redist/vcredist_x64.exe
    • Size 5.5MB
    • SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral25
    • Target
      Windowkill/_Redist/vcredist_x86.exe
    • Size 4.8MB
    • SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral26
    • Target
      Windowkill/_Redist/xnafx40_redist.msi
    • Size 6.7MB
    • SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistenceprivilege_escalation

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral27

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

steamdefense_evasiondiscoverypersistencephishing
Score
8/10

behavioral2

Score
3/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

discovery
Score
7/10

behavioral21

discoverypersistence
Score
7/10

behavioral22

discovery
Score
6/10

behavioral23

discovery
Score
7/10

behavioral24

discovery
Score
7/10

behavioral25

discovery
Score
7/10

behavioral26

discovery
Score
7/10

behavioral27

discoverypersistenceprivilege_escalation
Score
6/10