Analysis
- max time kernel
151s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 07:08
General
- Target Kalafior.CC.exe
- Size 64.9MB
- Sample260707-hydavab18z
- SHA256 5d9d2760371c98562b4fcf2fc0555187b0a410107b8841b840ed77eda628cdf4
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kalafior.CC.exe"C:\Users\Admin\AppData\Local\Temp\Kalafior.CC.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/6120-5-0x0000010993EF0000-0x0000010994E40000-memory.dmp
memory/6120-13-0x0000010992D80000-0x0000010992FA0000-memory.dmp
memory/6120-29-0x0000010995BF0000-0x0000010995C40000-memory.dmp
memory/6120-33-0x0000010998830000-0x0000010999020000-memory.dmp
memory/6120-37-0x0000010995060000-0x0000010995080000-memory.dmp
memory/6120-53-0x0000010995D90000-0x0000010995DB0000-memory.dmp
memory/6120-69-0x0000010995E50000-0x0000010995E70000-memory.dmp
memory/6120-65-0x0000010997EE0000-0x0000010997F10000-memory.dmp
memory/6120-76-0x0000010997F40000-0x0000010998040000-memory.dmp
memory/6120-88-0x000001099B2B0000-0x000001099B2E0000-memory.dmp
memory/6120-84-0x000001099BD20000-0x000001099C490000-memory.dmp
memory/6120-108-0x000001099B270000-0x000001099B280000-memory.dmp
memory/6120-112-0x000001099B3A0000-0x000001099B3C0000-memory.dmp
memory/6120-96-0x000001099B340000-0x000001099B380000-memory.dmp
memory/6120-93-0x000001099D290000-0x000001099D440000-memory.dmp
memory/6120-80-0x000001099B210000-0x000001099B260000-memory.dmp
memory/6120-61-0x0000010995E30000-0x0000010995E50000-memory.dmp
memory/6120-57-0x0000010995DD0000-0x0000010995DF0000-memory.dmp
memory/6120-49-0x0000010995C40000-0x0000010995C60000-memory.dmp
memory/6120-45-0x00000109950B0000-0x00000109950C0000-memory.dmp
memory/6120-124-0x000001099DEB0000-0x000001099DEE0000-memory.dmp
memory/6120-128-0x000001099DF20000-0x000001099DF40000-memory.dmp
memory/6120-104-0x000001099DC40000-0x000001099DEB0000-memory.dmp
memory/6120-100-0x000001099D6E0000-0x000001099D8B0000-memory.dmp
memory/6120-120-0x000001099D970000-0x000001099D990000-memory.dmp
memory/6120-41-0x0000010995D10000-0x0000010995D90000-memory.dmp
memory/6120-25-0x0000010995B40000-0x0000010995B80000-memory.dmp
memory/6120-21-0x0000010995AB0000-0x0000010995B00000-memory.dmp
memory/6120-17-0x0000010995950000-0x0000010995AB0000-memory.dmp
memory/6120-9-0x0000010996DC0000-0x0000010997CE0000-memory.dmp
memory/6120-117-0x000001099D440000-0x000001099D500000-memory.dmp
memory/6120-132-0x000001099E040000-0x000001099E0E0000-memory.dmp
memory/6120-145-0x000001099E690000-0x000001099E740000-memory.dmp
memory/6120-141-0x000001099E220000-0x000001099E2A0000-memory.dmp
memory/6120-136-0x000001099E140000-0x000001099E1A0000-memory.dmp
memory/6120-152-0x000001099E7E0000-0x000001099E810000-memory.dmp
memory/6120-148-0x000001099DF60000-0x000001099DF80000-memory.dmp
memory/6120-160-0x000001099E810000-0x000001099E830000-memory.dmp
memory/6120-156-0x000001099E8F0000-0x000001099E970000-memory.dmp
memory/6120-168-0x000001099E970000-0x000001099E990000-memory.dmp
memory/6120-164-0x000001099E9C0000-0x000001099E9F0000-memory.dmp
memory/6120-172-0x000001099EB20000-0x000001099EB70000-memory.dmp
memory/6120-197-0x000001099EB90000-0x000001099EBA0000-memory.dmp
memory/6120-193-0x000001099EBA0000-0x000001099EBB0000-memory.dmp
memory/6120-189-0x000001099EA60000-0x000001099EA70000-memory.dmp
memory/6120-185-0x000001099EF30000-0x000001099EFA0000-memory.dmp
memory/6120-181-0x000001099ED60000-0x000001099EEC0000-memory.dmp
memory/6120-203-0x000001099EFC0000-0x000001099F0A0000-memory.dmp
memory/6120-205-0x000001099F290000-0x000001099F300000-memory.dmp
memory/6120-209-0x000001099F590000-0x000001099F760000-memory.dmp
memory/6120-213-0x000001099F0A0000-0x000001099F0C0000-memory.dmp
memory/6120-217-0x000001099EBD0000-0x000001099EBE0000-memory.dmp
memory/6120-221-0x000001099F380000-0x000001099F390000-memory.dmp
memory/6120-225-0x00000109A5E60000-0x00000109A5F60000-memory.dmp
memory/6120-229-0x0000010999020000-0x00000109992BE000-memory.dmp
memory/6120-233-0x00000109A5CE0000-0x00000109A5D40000-memory.dmp