Analysis
- user interaction
yes - max time kernel
899s - max time network
541s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 16:24
General
- Target kk.exe
- Size 11.2MB
- Sample260620-twprmsfz2l
- SHA256 062d525facad55b70e759da8c9bd925c07317da904ecb640e56b9ec8bf42560a
Malware Config
Signatures
- Loads dropped DLL 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kk.exe"C:\Users\Admin\AppData\Local\Temp\kk.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kk.exe"C:\Users\Admin\AppData\Local\Temp\kk.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyarmor_runtime.pyd
python312.dll
pywintypes312.dll
select.pyd
Lorem ipsum.txt
ucrtbase.dll
win32crypt.pyd
memory/792-157-0x00007FF876020000-0x00007FF876032000-memory.dmp
memory/792-160-0x00007FF879590000-0x00007FF87959C000-memory.dmp
memory/792-133-0x00007FF863A10000-0x00007FF863F43000-memory.dmp
memory/792-118-0x00007FF87C550000-0x00007FF87C55D000-memory.dmp
memory/792-137-0x00007FF87B100000-0x00007FF87B125000-memory.dmp
memory/792-138-0x00007FF870070000-0x00007FF8700A3000-memory.dmp
memory/792-116-0x00007FF87B0C0000-0x00007FF87B0D9000-memory.dmp
memory/792-140-0x00007FF86F580000-0x00007FF86F64E000-memory.dmp
memory/792-131-0x00007FF8795B0000-0x00007FF8795C6000-memory.dmp
memory/792-106-0x00007FF87C560000-0x00007FF87C56F000-memory.dmp
memory/792-144-0x00000000648C0000-0x000000006496F000-memory.dmp
memory/792-126-0x00007FF87AE10000-0x00007FF87AE1F000-memory.dmp
memory/792-112-0x00007FF87AE30000-0x00007FF87AE5D000-memory.dmp
memory/792-148-0x00007FF86D200000-0x00007FF86D228000-memory.dmp
memory/792-151-0x00007FF86D1D0000-0x00007FF86D1FE000-memory.dmp
memory/792-110-0x00007FF87B0E0000-0x00007FF87B0FA000-memory.dmp
memory/792-104-0x00007FF87B100000-0x00007FF87B125000-memory.dmp
memory/792-154-0x00007FF8795A0000-0x00007FF8795AB000-memory.dmp
memory/792-125-0x00007FF87AE20000-0x00007FF87AE2D000-memory.dmp
memory/792-99-0x00007FF863F50000-0x00007FF864618000-memory.dmp
memory/792-130-0x00007FF863F50000-0x00007FF864618000-memory.dmp
memory/792-164-0x00007FF87B0E0000-0x00007FF87B0FA000-memory.dmp
memory/792-159-0x00007FF87AE10000-0x00007FF87AE1F000-memory.dmp
memory/792-180-0x00007FF87AE10000-0x00007FF87AE1F000-memory.dmp
memory/792-179-0x00007FF879590000-0x00007FF87959C000-memory.dmp
memory/792-178-0x00007FF876020000-0x00007FF876032000-memory.dmp
memory/792-161-0x00007FF863F50000-0x00007FF864618000-memory.dmp
memory/792-163-0x00007FF87C560000-0x00007FF87C56F000-memory.dmp
memory/792-162-0x00007FF87B100000-0x00007FF87B125000-memory.dmp
memory/792-184-0x00007FF87AE20000-0x00007FF87AE2D000-memory.dmp
memory/792-185-0x00007FF863A10000-0x00007FF863F43000-memory.dmp
memory/792-183-0x00007FF87C550000-0x00007FF87C55D000-memory.dmp
memory/792-182-0x00007FF87B0C0000-0x00007FF87B0D9000-memory.dmp
memory/792-181-0x00007FF87AE30000-0x00007FF87AE5D000-memory.dmp
memory/792-177-0x00007FF8795A0000-0x00007FF8795AB000-memory.dmp
memory/792-176-0x00007FF86D1D0000-0x00007FF86D1FE000-memory.dmp
memory/792-175-0x00007FF86D200000-0x00007FF86D228000-memory.dmp
memory/792-174-0x00000000648C0000-0x000000006496F000-memory.dmp
memory/792-173-0x00007FF86F580000-0x00007FF86F64E000-memory.dmp
memory/792-172-0x00007FF870070000-0x00007FF8700A3000-memory.dmp
memory/792-170-0x00007FF8795B0000-0x00007FF8795C6000-memory.dmp