bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KivunTerminal.exe
Size 165KB
Sample260702-cmcmaaa141
SHA256 bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b
MD5 0b6f3fdbec32889cb8f51ff14b9c1470
SHA1 8d21b2b63dd9440e6529508bf430f13f62120c71
SHA512 dca3c2a4083cf514a8be8f51f611dd1a222f07544d01d672b8566bdafbddbe8d23814f8f6b8098168843f5c2f9224709aa4fd17b0230a73d8a4e26c54febcad2
SSDEEP 3072:5X5iOhyOweJrhVQ6KB06quUGWc6vUpuI8s5SHsw:ThyO1rXKBtquUGNpS0
TLSH
T152F33883B2A521E4E3338D388AE10515A7737D360B685FDB13983255AE33ACC5D3BB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4948	mshta.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2748	2468	KivunTerminal.exe	86
PID 2748 wrote to memory of 3844	2748	cmd.exe	88
PID 3844 wrote to memory of 2344	3844	cmd.exe	89
PID 2344 wrote to memory of 2924	2344	cmd.exe	90
PID 2748 wrote to memory of 3848	2748	cmd.exe	91
PID 2748 wrote to memory of 3044	2748	cmd.exe	92
PID 2748 wrote to memory of 1132	2748	cmd.exe	93
PID 2748 wrote to memory of 4948	2748	cmd.exe	94
PID 4948 wrote to memory of 1416	4948	mshta.exe	95
PID 1416 wrote to memory of 2328	1416	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\KivunTerminal.exe
"C:\Users\Admin\AppData\Local\Temp\KivunTerminal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\kivun-terminal.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\kivun-detect-distro.cmd" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wsl -l -q 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Windows\system32\wsl.exe
        
        wsl -l -q
        5⤵
        
        PID:2924
- - C:\Windows\system32\wsl.exe
    wsl --version
    3⤵
    PID:3848
- - C:\Windows\system32\wsl.exe
    wsl --status
    3⤵
    PID:3044
- - C:\Windows\system32\wsl.exe
    wsl -l -v
    3⤵
    PID:1132
- - C:\Windows\system32\mshta.exe
    mshta.exe "C:\Users\Admin\AppData\Local\Temp\folder-picker.hta"
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c wsl.exe -d Ubuntu -- sh -c "cat $HOME/.claude/sounds/config.json" > "C:\Users\Admin\AppData\Local\Kivun-WSL\kivun-sound-config.tmp.json" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Windows\system32\wsl.exe
        
        wsl.exe -d Ubuntu -- sh -c "cat $HOME/.claude/sounds/config.json"
        5⤵
        
        PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LAUNCH_LOG.txt

Path C:\Users\Admin\AppData\Local\Kivun-WSL\LAUNCH_LOG.txt
Size 6KB
SHA256 0cd6ac182eed6000f5d8ad0d15b6fc1262babbb30ccaf2a58d84b219cd1d3628
MD5 e7b5cf89106c8fc9564344ff411560a3
SHA1 7982eb5f43c51d0462cf1e5db63e4aade66838d8
SHA512 d7b9f953e16622314eaf47dae1ddb97b25e12c0779962f1d8b9e0a75c01510f04928a633b217e2b51cd41ff045d54fef79e34af3a1973c74c9712941fdeaeb16
SSDEEP 192:bBmvWIWMcgMfYXmvWIWMcgMfYMmvWIWMcgMfYc:bBvd8vd9vdn
TLSH
T1A6E10753ABEA5114F2F2AF54B87A42744A677C4A5C3DD99C12CC540D0BF7B08D4B8BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kivun-sound-config.tmp.json

Path C:\Users\Admin\AppData\Local\Kivun-WSL\kivun-sound-config.tmp.json
Size 2KB
SHA256 d39a2e1e4bf452f2d63e8e96e99ff59a3668e165e4eeb894d7b8524301459eb9
MD5 88ae1537412ef9c091e6c0557a8810ad
SHA1 adf99cf805686759a6b64d8d6c33a78205c12418
SHA512 bc9167cc6313ee9e65f891eaef36f55b3ed8df71c9a1d2801b4e6645dfc8d9ae42134ee5ee1d8a14b596e4361f0d244c9cd642677c059c7cd2ba1f912f47eed3
TLSH
T16241B353A3EA5514F2F22F54B87A52740A677C4A9C3DD99C22CC641D4BF7A08E4B0FA3
MD5 SHA1 SHA512 TLSH