bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KivunTerminal.exe
Size 165KB
Sample260702-cmcmaaa141
SHA256 bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b
MD5 0b6f3fdbec32889cb8f51ff14b9c1470
SHA1 8d21b2b63dd9440e6529508bf430f13f62120c71
SHA512 dca3c2a4083cf514a8be8f51f611dd1a222f07544d01d672b8566bdafbddbe8d23814f8f6b8098168843f5c2f9224709aa4fd17b0230a73d8a4e26c54febcad2
SSDEEP 3072:5X5iOhyOweJrhVQ6KB06quUGWc6vUpuI8s5SHsw:ThyO1rXKBtquUGNpS0
TLSH
T152F33883B2A521E4E3338D388AE10515A7737D360B685FDB13983255AE33ACC5D3BB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	6092	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2856	2700	KivunTerminal.exe	88
PID 2856 wrote to memory of 3868	2856	cmd.exe	90
PID 3868 wrote to memory of 5388	3868	cmd.exe	91
PID 5388 wrote to memory of 764	5388	cmd.exe	92
PID 2856 wrote to memory of 4240	2856	cmd.exe	94
PID 2856 wrote to memory of 1864	2856	cmd.exe	95
PID 2856 wrote to memory of 4980	2856	cmd.exe	96
PID 2856 wrote to memory of 6092	2856	cmd.exe	97
PID 6092 wrote to memory of 4600	6092	mshta.exe	98
PID 4600 wrote to memory of 5664	4600	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\KivunTerminal.exe
"C:\Users\Admin\AppData\Local\Temp\KivunTerminal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\kivun-terminal.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\kivun-detect-distro.cmd" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wsl -l -q 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5388
    - - C:\Windows\system32\wsl.exe
        
        wsl -l -q
        5⤵
        
        PID:764
- - C:\Windows\system32\wsl.exe
    wsl --version
    3⤵
    PID:4240
- - C:\Windows\system32\wsl.exe
    wsl --status
    3⤵
    PID:1864
- - C:\Windows\system32\wsl.exe
    wsl -l -v
    3⤵
    PID:4980
- - C:\Windows\system32\mshta.exe
    mshta.exe "C:\Users\Admin\AppData\Local\Temp\folder-picker.hta"
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c wsl.exe -d Ubuntu -- sh -c "cat $HOME/.claude/sounds/config.json" > "C:\Users\Admin\AppData\Local\Kivun-WSL\kivun-sound-config.tmp.json" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\Windows\system32\wsl.exe
        
        wsl.exe -d Ubuntu -- sh -c "cat $HOME/.claude/sounds/config.json"
        5⤵
        
        PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kivun-sound-config.tmp.json

Path C:\Users\Admin\AppData\Local\Kivun-WSL\kivun-sound-config.tmp.json
Size 338B
SHA256 1b3cffe19cdebcfe567954f1664bdaeebd1f8431de2224be7d92b761699e30c0
MD5 e03347632e935440e5f0128eca84ca3d
SHA1 af69cf914dfcae45a039178ae79f3f327bce2a4f
SHA512 e003e0dca2376575c8c2e31204c598c38aeee04ae5f9b9d2262c57af22af28a6a29eaebf4f395e9acb10c711e5fed39e5f92f61803386ed7363b63f97eb8b925
TLSH
T1EAE0E24313FA4104F6F72F5029F413B08B76BC69BE38C25E5280541D09E1DA0C830BA3
MD5 SHA1 SHA512 TLSH

Submit Download