3edfcf73566c32a8773bc28c9ccf49dedc01cbbadbf881b15f63f584e773574a

Sharing

Copy URL Twitter E-mail

General

Target
kawin-support-agent.zip
Size 4.6MB
Sample260908-wxvqdswerf
SHA256 3edfcf73566c32a8773bc28c9ccf49dedc01cbbadbf881b15f63f584e773574a
MD5 b6d14765e773b3d6698ae8a2e60c0c33
SHA1 42de5b6655409f085e3a1a7d1e150e1135f422d1
SHA512 addd79ff923558daa5d63d5a3f0cc79edb75f453c914061f1eeb92e9eb4cc7bcf0e9c0da7d7abf1665d489ce64caaa9a73edfc79e532036bb93e602cccdc50dc
SSDEEP 98304:MSAAm/uN0zFLMJQxytaEzjhGxZTuiYJCjtN4VKGVYCpqraPA7:MtBLMJSyQEfhGGiYJC5iErao7
TLSH
T1AF263364292F774AF6A37E7DCA0A9A4F5330D548E0F5F176708150FD6A0A39FB82530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  KawinSupportAgent.dll
- Size 382KB
- SHA256 820f8dc630cd251264bdf45355d9ea750433e5f82be32223f011c065f023f37a
- MD5 3e2aa5ce98e769319d7ce746a11017c7
- SHA1 d7f8c7c0cced28e07fe04cb1ded48f62c97a1d45
- SHA512 7dcf577937730fa68e163b7a73f1120bf04c465a24fbaaedbaec88d5d1fd8952572389708b094435478b1dccac93bfa5d23edefa464b279bc6f0e12c10bc9ada
- SSDEEP 6144:nb3lHWJJSOgw5o3DSq++cr9pcc9WWH9W9bXgkszvvelO1:nb3lHWJJSOgwvq++crV9dQTsbvJ
- TLSH
  T1C1847C0033F84B1DE2EFEBB3F4A1446987F6F547F1AADB9E4684A0A81991B52C541373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  KawinSupportAgent.exe
- Size 148KB
- SHA256 94b0e249e64aa734ff4f219ea4e492f364b9f4d31ff100be765d6d98d7dfd32e
- MD5 4c7c51943625ebefbc78e6f00c94aa86
- SHA1 3325904841aa1413692c10d1da88af9adaec8ecb
- SHA512 f6e41f282a56fdda2dba916fb83399f4a080afc04a333ce04fc36b861600b6bb577a8b7f89d3f9fe09ab66b33461b3ad42e8d04cb828af0cc4221bb7145d48d5
- SSDEEP 3072:gqeXA/4yIg9vkNPNu6H6xCYOiEUE265gJ9:gvgvkNFNaxm0EAJ
- TLSH
  T11DE33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral4 behavioral5
- Target
  Microsoft.Extensions.Configuration.Abstractions.dll
- Size 27KB
- SHA256 fefcdb267a73099cb90e5af56b5ef2bca59bed974339b3a6810352bde23537a6
- MD5 e1f852e450395bd9cad83625ca41afab
- SHA1 8a5c6332c4208e319e648c8850ab709c82efe48d
- SHA512 54fd5acaa24c426b42aee7b855b6614c9c1e2676d0f54683d4a2b059db7c9bda70988c6ceb43f488abc34759f575cbdb75c3f0649cf932cf5fa2f53a66cf2881
- SSDEEP 384:Hxrv7hVmaET50kv96TG/FwzzRjz6qMvckxGMCWsfNWCx5kHRN78DuNNPR9zbKrQV:97hUaETSkXZp32No8D69zQGF
- TLSH
  T1C1C26C6953AC9327CCAB1F71F5F1D4412E36E7E27811DA2E589EF1090867B805B32729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Microsoft.Extensions.Configuration.Binder.dll
- Size 41KB
- SHA256 beac12f7bba4e22cda2acd9ddfe944a4ed56abec414e084edd147bd5dad3c032
- MD5 1900efbf41f8bb57151cc942ef2a1222
- SHA1 8afa01360292efb640900a6cbcfad40b7f815776
- SHA512 eeccb907965099846c684fe1584dab1cbf74f0810ac89806827d85f0f456221fd42f0ec27197e9314a76e3980f3e2ad441d889a6d7af042ac8258207bfec46c4
- SSDEEP 768:JrGlacqrCJ6PTbIQG0mVdrxzMBnW+e9z2:Jrf3CJ6fIQG0kxzMFW+az
- TLSH
  T1E2134B1657E8C326F9FF0BB069B0E4954F76FAA26426D61C5C8D605D0C777808B223BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  Microsoft.Extensions.Configuration.CommandLine.dll
- Size 24KB
- SHA256 688ef791d4bb2e84839cfb28ec83772d561d958f6d0b20ca28be1c6efc9ea5f7
- MD5 2ebdc0b72eafb372036911dbf7ea1a9e
- SHA1 b4ce3f14ddbb8c0188c2f0b2f735512f3789df8d
- SHA512 82ae8f62c6ea58eeb54e116e8258db90db55f6c376ef572f52b580194d5974ad66cf1c62b329a322d681a937a4214b67f9b4e273335a90db662f3d7c55bd0517
- SSDEEP 384:4+6wnFbhCxwXaHsRJ0eDKfW9/nWCTb2HRN7jSR9zrZV:z6+FN04IcCSJ/i69zFV
- TLSH
  T10FB25B5697FC4217FDB70EB0A5B0E5452E39AB93AC21E62A185EB10C09B37804F7173E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  Microsoft.Extensions.Configuration.EnvironmentVariables.dll
- Size 20KB
- SHA256 797b3034fd173caff0850cd580428a5f4aeb7da27bf03369ad7f2b0996019399
- MD5 5636d243d19d4d7506cb8844458c3bdf
- SHA1 4575623dc6fc5c43718657e9c775cc2b48830155
- SHA512 b2176fa42bb1f20477102a1119adcf7b11c7e85dab1b5e6c937c5dd94d9e3068d8bbed7326d5c7c78a81f4705d3916a9d807e2522db75ea8114c05d52e55fd09
- SSDEEP 384:gSz0UpsW+K0ihWQS9WUPeWVC5kHRN7/NNPR9zbKmhBP:gc0ULPUrVD99zbhBP
- TLSH
  T14AA23B8593BC8202F8BB2B70D6F9D5622C39FBD26811892E155DF10E1C67B94CB61B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Microsoft.Extensions.Configuration.FileExtensions.dll
- Size 27KB
- SHA256 acf5896d0f34fa1a43295797584b3805c24743ce25ee87538eeec83b012bbf4f
- MD5 286b788d46e6b5379db22454b505bb7c
- SHA1 43ccaf65099f28cb93716dd9d16f0ed4043b35c9
- SHA512 430b62f8d74bd28b0eb1e80a6f956c82a1e57abde6995152cb745a619bdc872aaa2b5fcc0f4b2b5bba35d3b871604f911eeacd21f97d478cbb5cb8542be8ebbb
- SSDEEP 384:U1LlqiKysfF+LY9PLIMXABPJqWqH6WIdX6HRN7G2MR9zFTY:kUiTQnwxsstWGn9zF
- TLSH
  T1A7C25C1287FC8213C8BF1B30F9B4D5465A35A7D76811E56E599DE00819B33C09F72BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  Microsoft.Extensions.Configuration.Json.dll
- Size 26KB
- SHA256 15e1262880f263806a2808d750688739662323b20ccd9835222fff8c30899a4a
- MD5 38eeb1691c133b414ea2061720c574e6
- SHA1 263001a6a631974cf87c908a058941af79f5711c
- SHA512 550404cd20978d8607efd5ccfda035f77b48e40a272f95323fe60a39c029d71efdf63999770ad221cadcf1ed5d9630762164533d66b9bd5e9f4146eac35331ee
- SSDEEP 384:z6J1o5QgFMvUo0e1l6QUWkWJ2WFYA6VFHRN7aU9WR9zGZzP:k1sFMYhudFClA9zqzP
- TLSH
  T18BC26C5593ECC327E9BF1F3095B4D9452D39A7C26912EA1E099EE14A08773C08F3271A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Microsoft.Extensions.Configuration.UserSecrets.dll
- Size 24KB
- SHA256 206cad6a76676e1fe74e12cea23d92aa7ae3eb06217315617f6f267af1383e58
- MD5 a01648a8751dd427461fa3fbd8096441
- SHA1 f34c91eb09ecd37f35145defbdd6d10a88699919
- SHA512 fc1cc0e36ca0b8364c5e06a8433a67ba219e2f52edfea74d104a39de9ab5d50a2864ffeebc53ee2803d799766314d05ac29dfebe7e32a5db030cf1b2e658f362
- SSDEEP 384:R/sfDn/NGfzRxL1iF0gzE1L/W9yVCWVYA6VFHRN76l9WR9zGt:8lGlxc8NhFCl6y9zi
- TLSH
  T145B25B8AA3FC4322F97F0E32E579E4455E39BF969C12A62D049DA00D1877BC4DB31729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  Microsoft.Extensions.Configuration.dll
- Size 42KB
- SHA256 b5cd9da2c3364a5b201cecb0c80e25227d27ba44d96343d2894ff8ef3fd81550
- MD5 ebf181ef6f8cbfdd9149d9d609059051
- SHA1 05cd721a76c1afb00df1b6417e6b8b1a7f344e67
- SHA512 fa2f59833721fb50500d89ae5a3c8c7474e247a684440c01bd30d46a8962cbcbe8f216d41bba9ebc075ac2e1ee19c37a46d0e1db922db23a3e261b5c68155877
- SSDEEP 768:MLJOZTEW1WTsTeVnrI/yqCtHUafO+ukucyOgn9zT8B:MLJOpEQzTp/AX2+uMyOg9zTc
- TLSH
  T1D8135D5A63AC8B2BC67E0B76F5F0A9451F39D2477912E71E4C9EB09609273C04B1273B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
- MD5 e61d0a82bb0deab84b3c1e75df6f5b0b
- SHA1 f1b7207ffc54183e96ad1da76401f896a030dea1
- SHA512 0f3cf57fd108ef397f510e6635dcc16568560c6d40600d80e27d2976d172b3ad8f43bc1970c771ca772090169333139be9ea00118958e1fbd47db395088b28bd
- SSDEEP 1536:+DHW/pHp2Dp9edpX0Pnaw2oR7uhQDt8TIg6dKdQ1W6azK:qakQWDqTZ6dEQ1em
- TLSH
  T185533A6473F8677BCBEF4A70267650204B74BE471043F7163A6AC0B519A3BC84961EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Microsoft.Extensions.DependencyInjection.dll
- Size 90KB
- SHA256 158761ce778e799949f3a3060c461b1055bb35f1f5a65eff0e42397849f09ecd
- MD5 ec9754049bb1b696f4fdda765e55dc73
- SHA1 8a06f022eb13670a06138811aa406177867253ed
- SHA512 ef8f997221049a3c8faec3cfe3ae62fd689e60b3c675da2b7eb2f9740519a2984ff199e882931bc05ee9c8c884dce09c624e6f3684c7e456172cc7c0f1b78dd7
- SSDEEP 1536:HikoH+bvkw5ZSHZrt1xDtSN6A3vMZ+t5TvZdGpNeCWWo/Ep4zB:CHH+bkwU5rW3vJtvZdG6CWx/Xd
- TLSH
  T151935C25A3EC4B26EAEF1574687440004FB5EA9B3103D74D6E94E4AD1EA3FC14B712B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  Microsoft.Extensions.Diagnostics.Abstractions.dll
- Size 29KB
- SHA256 9864dbcfdbfe395bbd64deec7568fdaf0cbc3850f0cd8f53e7359189bd158082
- MD5 8c79f5fbf8ce8eb2dd851dea54735d1f
- SHA1 5ad81d2a8e2e0fa8d44a5438edf9d834ec0517ec
- SHA512 d4bb78fe5e191a9fbf42b1259d1267e205e5e59c3e6493ec18270dbfeea30e0c617447ef67c2df93e48beca85f995c20a093deb3a52dbcd4ee112001a708c069
- SSDEEP 384:tzVZvGPhQTlrYouEsdS+YlOjqm6t4BWOXURWNYA6VFHRN7wsjR9zDmEf:tP+5QqnHNfG8FClwsF9zTf
- TLSH
  T16ED25C91DBBC9326EDBB1D31A6B4C4411A36C3976800E76E4DC8D40C1A33BE49A71B79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Microsoft.Extensions.Diagnostics.dll
- Size 34KB
- SHA256 31e08b4e0018ee136d65dfcca8f655a1a74cf8841e6029044c99b2e75d5f59f0
- MD5 85093d346f4610957b61ede039e2b51f
- SHA1 870bf5320c82e509721f20b1ac541165a4a460ed
- SHA512 ab445d141e79d710a2598562217c1a9964404f765eaee7d4788431ba96a24e772f25523ff3f6dd659119fee4ed4b39fa5a7da1d7980436bff5a56c9f109738be
- SSDEEP 768:BCuMWVBZb1mpK3/uTYBmJf4zFClZF9z8u:BC6Ip0XWwhiJzX
- TLSH
  T1FCF24C5AB7AC432AC8BB2EB4FAF0C5422B39C6D36801F7595DDCD0990C677D44622379
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  Microsoft.Extensions.FileProviders.Abstractions.dll
- Size 21KB
- SHA256 f08b1f597abb3647ab6e844282ded763e6078dbef6dd54b9d956ca419fac42fe
- MD5 504acfd4f683b6f4859d240c1f6cd749
- SHA1 ae54915150997136f132bf61bdd9e7859f56d9bb
- SHA512 a05f8507a8830ac33c45942bae06c49a23242f35b4c01b3d677f8fef0199c8cdbd956967bb73374bc52956d3bbfc82d422885800006c644d4c4aea4717287239
- SSDEEP 384:ggH8Tv2So+MVV1CMHWs/hWuTb2HRN7TI+R9zJKhJ:ggcTvlGFtr/iMi9zEhJ
- TLSH
  T178A25C66DFA88362CCFA0E7064A4CD473D3DD7E75801E92E0999E1091EF3B849631B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  Microsoft.Extensions.FileProviders.Physical.dll
- Size 43KB
- SHA256 9f67076c79a953f5068c0792114f9722527cfa17ed7414c73fd14833bfe59918
- MD5 08ac1d14ad47498891953e40909fe293
- SHA1 996492040743ce3af3734e07ed1610a6ab4ff375
- SHA512 0a108f138dd52bb47892d836f0d54eeeac00e9218abc02964316e3bbfad25d54b095e4c7d7d676922246ad42998cb37745c7ce9cf4a7e0c30f7742d37d89cb08
- SSDEEP 768:/0uMdRozKWWyAWxcnuHeHopdtU6LCxZF+dD/ic9zxz:/PMSeWWyZcnuHeIpdtUxZF+dTiUzR
- TLSH
  T13D138D22A3EC4317CAFE5BB029B0F5460735F3DB6102FB5E1D59B18A389378457606BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32