8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6

Sharing

Copy URL Twitter E-mail

General

Target
kl.exe
Size 1.7MB
Sample260801-pkrdwaveka
SHA256 8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6
MD5 13f377dd0e67abcdb266bc2433bccaca
SHA1 ffeb81b2270cabd47a30719c2c6b6a824878925f
SHA512 6aacb1365a1812f6ee402598c5bf5969e25091c5502e4ea07d407776b09ed58fb32f9efabbc07ca0b50035c98636b8bee5b96f01afa4b5f4a89541c4480d4594
SSDEEP 49152:Pc/OpzSXnBOxfAnyv3TnYZVKVC6mE8vN41AboWe:U/iinBOxGIcVjv0AbW
TLSH
T14185339657E09879D2611E3148FFF9343A37CD414827F7EBBB784F3120A2597AE2A814
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  kl.exe
- Size 1.7MB
- SHA256 8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6
- MD5 13f377dd0e67abcdb266bc2433bccaca
- SHA1 ffeb81b2270cabd47a30719c2c6b6a824878925f
- SHA512 6aacb1365a1812f6ee402598c5bf5969e25091c5502e4ea07d407776b09ed58fb32f9efabbc07ca0b50035c98636b8bee5b96f01afa4b5f4a89541c4480d4594
- SSDEEP 49152:Pc/OpzSXnBOxfAnyv3TnYZVKVC6mE8vN41AboWe:U/iinBOxGIcVjv0AbW
- TLSH
  T14185339657E09879D2611E3148FFF9343A37CD414827F7EBBB784F3120A2597AE2A814
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH
  T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/ShellExecAsUser.dll
- Size 7KB
- SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
- MD5 86a81b9ab7de83aa01024593a03d1872
- SHA1 8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be
- SHA512 cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac
- SSDEEP 96:GFZf6PnleKYcBVGKLyhkrw0qyz/sRXQVgKXohw8FFtkqCp:Gnf6IKTAKLyGOCqQomItQ
- TLSH
  T167E1097A56D288A1E11E07746A975E7B13AD6A1203B00431CB471FCE2DF5456F42FA4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  silentkeyloggerfree.chm
- Size 65KB
- SHA256 f5568ff85d942a9f26bcd3d45b0b5ea0d1a546294afe9f04d73abc0693b5765d
- MD5 fbe4d1bb3bfb2e5c2d206e58c157717a
- SHA1 704a1e22af0016652c660a5163a397db8b705006
- SHA512 978477d72c72efd26472da223d4a35ae28e181ad7d593613ed07707822e6cd605f1fe10331500f66a01555070c5ee2c3e86df1b40614af63eb38b87f7667c096
- SSDEEP 1536:bUJdWX9TWv4gWFTWuyZTH1pOSNP6FAGTtqbruyJ1vMf:I3cEhWAuyFLmFAGTtqbD1q
- TLSH
  T11E5302F00D508276E8AE037B4FA4AEC45AA0DF059D2D5E44037EB9A6A5F734307D82BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  silentkeyloggerfree.exe
- Size 3.7MB
- SHA256 66bc2781bed323d8f68be09c04427f79a2bd80ecc855a782bf398d06c99131f9
- MD5 5fa4133b4d07cc5aecf6afe85f045835
- SHA1 59202554877fb4bfbb8b01b0da855aabab27fa19
- SHA512 fccbf9fd1675ea7d974f71837fb73862ab7a8057a2c2426c4376278691ab0d7457532d78d2bcc55be0a22683d929aad86d41085e9fd491be182fcef07acb8474
- SSDEEP 49152:u3Lq+Q4wTAu+BWY2a14MsepwcjeF2QLhY6dKChtmmj+qV4hc84wyCAIjPzBwTW6M:o24I+kYt14MsepwkRUAt
- TLSH
  T160069DF1BEC059A7C3D30730690EF17832BCAEE45BF9919F63943B086DB529311159AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral11 behavioral12
- Target
  ulklfemon.dll
- Size 2.0MB
- SHA256 9768fd324a5bbab21ae793ddacf398e2593578e1a8e46894e8fefba3b676e62b
- MD5 bfff87d4246b9a68e04e7d3779b9544b
- SHA1 49b717eb2a177c899748848b48534733356d70ee
- SHA512 aaf139b631c36f315f1f79776b0a8783c7ce9c966c8b7f9494836b93548fdf473ed9ad4914ff33e860459efafebe74f9a8f483569688e150084b199200ab3a58
- SSDEEP 49152:OpjOA3kxS8YwOvVL1LNP6j85Gr18Mrxq:OdOA3N8YTV1LNP6j8Mp8M
- TLSH
  T184A58D22BEE0857BC16F03314D1EF23C31FDA5230B7981CB67D85B2869306A2665976F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  unukfree.exe
- Size 121KB
- SHA256 bad07ed1f054dbc26f4216264f90e99bedbef92fd0ddf46f2db02c5e3272babc
- MD5 548e555e793773eb8f28b1e884c73105
- SHA1 742d4727e4949fdaa5111ad4e2ddc0f30d4bcca3
- SHA512 05326ad4df74aaddfb4c4fd8f846188f9a2a0bc29ee54233575b645346c98f6625514c4e94a501720d62962e2a90f72a665d1cc1d485a1139f11e52edc537a9d
- SSDEEP 3072:iPA6jXFN2McHqHH75KLs47XsZevYtwwU+FVh0:ihjmSHb5KRX0wuh0
- TLSH
  T1BAC3E012B3D0CCBBE56D167298BB97A443B1DC15121222972361BF7FEC76392891BB43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH
  T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18