292e5b0e7d1145a51652ba84547edee6227a9f4575923ae7c8a07b6087e02d6d

General

Target
kiriri_new.exe
Size 85.7MB
Sample260803-swf9tsbe35
SHA256 292e5b0e7d1145a51652ba84547edee6227a9f4575923ae7c8a07b6087e02d6d
MD5 70fc6080077ccc4aa3e43f76efa9f3fa
SHA1 928f3d18ac929b460c523d8ddb4097b4a722df91
SHA512 f4022b203c1e6c6c496929fc0a0f4b7dc276c1ea1f051c64ebdd9e804592aa1f5ff321c693b8cd815ae5be884cdd02557d7f87c7a68b67687d02ae9d4b271bc7
SSDEEP 1572864:WrvUMOtPWouHKO+dy2J0f0/rBdsG7bpip0WWRiIhK4cNhZu665/Rcq:WTUXZuHI5BB7tE0Wko4cb83zcq
TLSH
T1AA18339978D5626FE60A4732E2D5D93D2B930A8D97AA80CC1E980D075BF30C9CD7DC36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  kiriri_new.exe
- Size 85.7MB
- SHA256 292e5b0e7d1145a51652ba84547edee6227a9f4575923ae7c8a07b6087e02d6d
- MD5 70fc6080077ccc4aa3e43f76efa9f3fa
- SHA1 928f3d18ac929b460c523d8ddb4097b4a722df91
- SHA512 f4022b203c1e6c6c496929fc0a0f4b7dc276c1ea1f051c64ebdd9e804592aa1f5ff321c693b8cd815ae5be884cdd02557d7f87c7a68b67687d02ae9d4b271bc7
- SSDEEP 1572864:WrvUMOtPWouHKO+dy2J0f0/rBdsG7bpip0WWRiIhK4cNhZu665/Rcq:WTUXZuHI5BB7tE0Wko4cb83zcq
- TLSH
  T1AA18339978D5626FE60A4732E2D5D93D2B930A8D97AA80CC1E980D075BF30C9CD7DC36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1