Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:16
Static task
static1
Behavioral task
behavioral1
Sample
12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe
Resource
win10v2004-20241007-en
General
-
Target
12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe
-
Size
312KB
-
MD5
7304244070456825516674275bd20f60
-
SHA1
fc8f6e2d1bb3a62cc0fb0cbff102261b9f9e5fbf
-
SHA256
12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1
-
SHA512
883d1666607735cd4965ff93ff6d3651f771d1b21b673f342d9721bc7cb04bd78f6db717155c7d1b04a4b2ab73bead4b5863a213927193ad54936e36949a65a3
-
SSDEEP
6144:YGOXfUdRT6mCo4Em3d1k91UmaFycSbGqJWs6eQ/g7:YGOSRT6mChEm3dOXURtS96H/g7
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Executes dropped EXE 1 IoCs
Processes:
kifkuel.exepid Process 4472 kifkuel.exe -
Drops file in Program Files directory 2 IoCs
Processes:
12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exekifkuel.exedescription ioc Process File created C:\PROGRA~3\Mozilla\kifkuel.exe 12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe File created C:\PROGRA~3\Mozilla\vrazdod.dll kifkuel.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exekifkuel.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kifkuel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe"C:\Users\Admin\AppData\Local\Temp\12f452f19a0703e9ed33ab76d7ba0286460beeed69ee0042e0ba8b6c2b0f99d1N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4928
-
C:\PROGRA~3\Mozilla\kifkuel.exeC:\PROGRA~3\Mozilla\kifkuel.exe -dljjxbn1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD5c8a3049a8ccce0985106360d1c509030
SHA15065094e9f28410c00af184eba5b1c826c1f134c
SHA256350efb90a2130ffe4071b5b5a31bb7442f2e299f958b977a18ca4c46a7f9bbc4
SHA512fbdf8fb3de9b0e3eefdb4116aaccdefa2ae1098a3bed3259c2cafa864a415ddc291560e530c130437979a13b4c710b5462700827f50c878f346eb1950b0939ce