Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 16:18

General

  • Target

    $TEMP/KWMUSIC/DownloadUpdate.exe

  • Size

    119KB

  • MD5

    10ec15eb29b071eb1073b48c6c1b7678

  • SHA1

    7fb49616109fee0abda4185f3fe77106594ef976

  • SHA256

    e14fa67ee50836ad7573fd7ea443bce6bcd2a86e730e71c8c4248a5f108101a5

  • SHA512

    86f52099138397434488aaacb30d5d0125081f1928e385117d59e581ade3eafb8c554f9e7763a976d8645bbaaf6bea6b6fe03b51d8900d10a3af10403764f3b0

  • SSDEEP

    3072:4ZGlFw7fonu4sPJBWU4LATKscUoENR5lfxzbl+/:YWwMnudZiCRcWBlZvl+/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\KWMUSIC\DownloadUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\KWMUSIC\DownloadUpdate.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2240

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\KuWoNsis_new.dll

          Filesize

          101KB

          MD5

          5b7d3fc9651089f373df83a9bdc922a7

          SHA1

          e0ee059b261e89bef6bdc9392ea4a579686a410f

          SHA256

          cb1e6695c6d55c3bd4b8d12cbe6a2e48687e72c84223256a3431560b2d4d7e59

          SHA512

          5feaf4de80e9057c9b3fc2d5ef2a5b7ef857fa7de67e5e5aa56915d06cd42b8544a8e707140bf182ad4907fc51a022fa597316f27e481abe170ba2548d64f911

        • \Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\inetc.dll

          Filesize

          18KB

          MD5

          94a8ace2be90a687c1b1729c32c66e50

          SHA1

          94cff89cc170c00b1f849460f78cb12ab8730538

          SHA256

          1a6c160fd844dea35195371476119f91eab302d701b0f6f1c3fe87ad92cc93df

          SHA512

          ba23dfa7a29450451ac3f6ef6bf9e89352e1d17f7a2b7c7e5a87839becd6676542d2189d443322b3cad08b1bcac8851eebf9964fa37190e551f0bd717dcc5deb

        • memory/2240-61509-0x0000000010000000-0x0000000010009000-memory.dmp

          Filesize

          36KB