Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2024 10:37
Behavioral task
behavioral1
Sample
Fps0ptimizer_ByKartavik.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fps0ptimizer_ByKartavik.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
Fps0ptimizer_ByKartavik.exe
-
Size
93KB
-
MD5
1a5e53bb0bcbcbb680fbb54a55a1c630
-
SHA1
5d420fbdfa84f3828ccbfa7ca1709edaddd22839
-
SHA256
865d9448dab0a512e40d8cf95d83cccdc9bb32806466d5ae3d2a30301f299a80
-
SHA512
1dcd0ac4af1b16770bf163060838f33fe534762d5b4e42d83c9733cdaaf827852a14f18bbccb4c802ef87f8fa3d39707a96bcc60e40e73b23043371a9537495a
-
SSDEEP
1536:HemC+xhUa9urgOB9mNvM4jEwzGi1dDYDLgS:HegUa9urgOidGi1dmE
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3584 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Fps0ptimizer_ByKartavik.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\48a41a18500fb55c8cc19095299f8b6aWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\48a41a18500fb55c8cc19095299f8b6aWindows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe -
Executes dropped EXE 1 IoCs
pid Process 4708 server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 13 0.tcp.eu.ngrok.io -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created F:\autorun.inf server.exe File opened for modification F:\autorun.inf server.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Explower.exe server.exe File created C:\Program Files (x86)\Explower.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fps0ptimizer_ByKartavik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe 4708 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4708 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe Token: 33 4708 server.exe Token: SeIncBasePriorityPrivilege 4708 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3736 wrote to memory of 4708 3736 Fps0ptimizer_ByKartavik.exe 83 PID 3736 wrote to memory of 4708 3736 Fps0ptimizer_ByKartavik.exe 83 PID 3736 wrote to memory of 4708 3736 Fps0ptimizer_ByKartavik.exe 83 PID 4708 wrote to memory of 3584 4708 server.exe 84 PID 4708 wrote to memory of 3584 4708 server.exe 84 PID 4708 wrote to memory of 3584 4708 server.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fps0ptimizer_ByKartavik.exe"C:\Users\Admin\AppData\Local\Temp\Fps0ptimizer_ByKartavik.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3584
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD51a5e53bb0bcbcbb680fbb54a55a1c630
SHA15d420fbdfa84f3828ccbfa7ca1709edaddd22839
SHA256865d9448dab0a512e40d8cf95d83cccdc9bb32806466d5ae3d2a30301f299a80
SHA5121dcd0ac4af1b16770bf163060838f33fe534762d5b4e42d83c9733cdaaf827852a14f18bbccb4c802ef87f8fa3d39707a96bcc60e40e73b23043371a9537495a
-
Filesize
5B
MD5c60feebd511c87b86dea130692995a0f
SHA1d64447a8b3d8949cab5a1f8d168f7c6fee6b6a0a
SHA256632994320c04707e7ef564b3e983a694170561659552a24dfe14a922dcf0f511
SHA512bf03fbf3329c6f7a21ecd620319ef1a6f676b22a27afd24aab546483c3fe5f6eee7bbcfdc14c5f6626957f2b96519bdd21aaea45d74a80253fa4220c8c12df7c