Overview

overview

6

Static

static

1

Kilohearts...er.exe

windows10-2004-x64

6

Resubmissions

06/08/2026, 13:20

260806-qlaceswxd16

06/08/2026, 12:15

260806-pe675svvdw6

Analysis

  • user interaction
    yes
  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/08/2026, 13:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Kilohearts Installer.exe
  • Size 14.9MB
  • Sample260806-qlaceswxd1
  • SHA256 8f4c7b2bfaf8b6668f4cbb3585da6460fa622bbb0c195d49f03e5cba8263ec46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasion

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kilohearts Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Kilohearts Installer.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops desktop.ini file(s)
    • Checks computer location settings
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\ProgramData\Kilohearts\Kilohearts Installer.exe
      "C:\ProgramData\Kilohearts\Kilohearts Installer.exe" "C:\ProgramData/Kilohearts\Kilohearts Installer.exe" C:\Users\Admin\AppData\Local\Temp\Kilohearts Installer.exe Kilohearts Installer --skipUpdate
      2⤵
      • Drops desktop.ini file(s)
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        affiliate
        • Path C:\ProgramData\Kilohearts\affiliate
        • Size 4B
        • SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
        • MD5 SHA1 SHA512
        Submit Download

        installer.update
        • Path C:\ProgramData\Kilohearts\installer.update
        • Size 14.9MB
        • SHA256 8f4c7b2bfaf8b6668f4cbb3585da6460fa622bbb0c195d49f03e5cba8263ec46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.update.meta
        • Path C:\ProgramData\Kilohearts\installer.update.meta
        • Size 50B
        • SHA256 1d607678bfb6ee4b4bb87afcedf4d35340e1f4346ae508f6afa45c57bf5fec0d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kiloHearts.log
        • Path C:\ProgramData\Kilohearts\kiloHearts.log
        • Size 571B
        • SHA256 4f19922fabe08e6a4e3c77cabb861ee465d7a2066088a87bf8d191c594dceaf0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kiloHearts.log
        • Path C:\ProgramData\Kilohearts\kiloHearts.log
        • Size 2KB
        • SHA256 1e800f1fc23437039db66c7c4a017b342e8f9ff37b06e558dda0c681df7c13a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kiloHearts.log
        • Path C:\ProgramData\Kilohearts\kiloHearts.log
        • Size 2KB
        • SHA256 30e7732006cb79d4e79e4ef612811fb96f172b057712dc6c84e27bed3e699a46
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        session
        • Path C:\ProgramData\Kilohearts\session
        • Size 112B
        • SHA256 76c851ca4f69ed481a1cdd25149172511f085063528cce959f764640372aea24
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\Documents\desktop.ini
        • Size 418B
        • SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
        • MD5 SHA1 SHA512 TLSH
        Submit Download