bf066388ba859d290970a6011de59455dcaa6059b0ca120213b0b601ffe59369

Submit
Reports

Overview

overview

Static

static

KiPoypXawe...IA.exe

windows11-21h2-x64

out.exe

windows11-21h2-x64

KiPoypXawe...er.exe

windows11-21h2-x64

$PLUGINSDI...er.exe

windows11-21h2-x64

KiPoypXawe...ll.bat

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...er.exe

windows11-21h2-x64

KiPoypXawe...er.ini

windows11-21h2-x64

KiPoypXawe...up.exe

windows11-21h2-x64

Resubmissions

01-12-2024 18:15

241201-wwd19axqbx 10

01-12-2024 18:07

241201-wqgj7axpct 10

Analysis

max time kernel
93s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-12-2024 18:07

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

4 signatures

Behavioral task

behavioral1

Sample

KiPoypXaweM/NVIDIA.exe

Resource

win11-20241007-en

evasion execution

windows11-21h2-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

out.exe

Resource

win11-20241007-en

windows11-21h2-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

KiPoypXaweM/Requirements/OverwolfInstaller.exe

Resource

win11-20241007-en

discovery persistence privilege_escalation

windows11-21h2-x64

12 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/OWInstaller.exe

Resource

win11-20241007-en

persistence privilege_escalation

windows11-21h2-x64

9 signatures

150 seconds

Behavioral task

behavioral5

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/install_all.bat

Resource

win11-20241007-en

discovery persistence privilege_escalation

windows11-21h2-x64

23 signatures

150 seconds

Behavioral task

behavioral6

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe

Resource

win11-20241007-en

discovery persistence privilege_escalation

windows11-21h2-x64

16 signatures

150 seconds

Behavioral task

behavioral7

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe

Resource

win11-20241007-en

discovery persistence privilege_escalation

windows11-21h2-x64

16 signatures

150 seconds

Behavioral task

behavioral8

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe

Resource

win11-20241023-en

discovery

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

11 signatures

150 seconds

Behavioral task

behavioral10

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

9 signatures

150 seconds

Behavioral task

behavioral11

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

9 signatures

150 seconds

Behavioral task

behavioral12

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral13

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral14

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe

Resource

win11-20241007-en

discovery

windows11-21h2-x64

5 signatures

150 seconds

Behavioral task

behavioral17

Sample

KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x86.exe

Resource

win11-20241023-en

discovery

windows11-21h2-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

KiPoypXaweM/Requirements/Windows Update Blocker/Windows Update Blocker.exe

Resource

win11-20241007-en

evasion

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

KiPoypXaweM/Requirements/Windows Update Blocker/Windows Update Blocker.ini

Resource

win11-20241007-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

KiPoypXaweM/Requirements/dxwebsetup.exe

Resource

win11-20241007-en

discovery persistence

windows11-21h2-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

out.exe
Size

653KB
MD5

6970ea0b6597dcd5b4f5f19f28e958a8
SHA1

a0130bb7ac03ec4799c90781ca93fd1392c6d54c
SHA256

481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
SHA512

bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01
SSDEEP

12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	2852	WerFault.exe	76

Processes

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
PID:2852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 8
  2⤵
  - Program crash
  PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2852 -ip 2852
1⤵
PID:5012

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads