900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1

General

Target
900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
Size 624KB
Sample261011-pd732sty4p
SHA256 900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1
MD5 b51505df06c78bf5d601db0e75030455
SHA1 130242f02c3ccc4293cd7d67737282d7a735f438
SHA512 662b14703ea99b238aa5b23d8eeedef1c12818639cb9b77b136105cb8736ceb6af0ef4fae4fed5378cdd907fa09e14ce24c916c87cdd1b8ea171c4faa5f08e2e
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+p:An4bgVhNrAM1qgg2jfO
TLSH
T1C7D47B1153E60116F1B79B3178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1160	knwhv.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	knwhv.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knwhv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4132	cmd.exe
4160	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4160	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4996	900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
1160	knwhv.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4132	4996	900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe	89
PID 4132 wrote to memory of 4160	4132	cmd.exe	91
PID 4132 wrote to memory of 1160	4132	cmd.exe	92
PID 1160 wrote to memory of 4532	1160	knwhv.exe	93

C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe
"C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\knwhv.exe "C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\knwhv.exe
    C:\Users\Admin\AppData\Local\Temp\\knwhv.exe "C:\Users\Admin\AppData\Local\Temp\900cfa621913048e9bcdce46177b40087fd8903a3d76367d44cb567f71f514c1.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\qzozjffi\yvvet.vey",RAFlush C:\Users\Admin\AppData\Local\Temp\knwhv.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

knwhv.exe

Path C:\Users\Admin\AppData\Local\Temp\knwhv.exe
Size 624KB
SHA256 3b84dddc98f03d273e0640edd53b6948611e5b7275d9c1dc23584835f07ec8ac
MD5 4adf06d1941953b0b45383428d7d5d05
SHA1 7766e4b2293f2e00902a3a7555a6ee829c423456
SHA512 2b6c2365eb8c27d0e187e5f05e6dc41de24f7d5b79ed48741e37b59006338710761d674000c8b6bd6f57228e9823cd81f2f0a5c6095fde6d70077991b1daf8bd
SSDEEP 6144:lnGfByMnN+3d1BraxNx1Gc9N6xJ/MO2N89M4qjGggUA0CthK1KLAb+AfQQIh+K+p:An4bgVhNrAM1qgg2jfO
TLSH
T140D47B1153E60116F1B79B3178F693B1693BBC06AA30D7DF7798BD2CC86A943A831316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvvet.vey

Path \??\c:\qzozjffi\yvvet.vey
Size 155KB
SHA256 42097ad9ae64e2ff7ed139fef0a7eb53c57a37c9215ebc275411841e198c3e02
MD5 a8c9fc170d8d954a4c27141f56db38f3
SHA1 3e9bd10e353469f8e540de675a63fed8cc70bdb7
SHA512 5793c869c862bb77d92a9045ed5a951bd57837b7d631c7ea03a1764f7f0c6ceae68bbfb1f6f7f3143829d5b53f5973d3f1f3e6afc47bd3822251f0beb5c37f9c
SSDEEP 3072:zqVT34l0v8ljGh11D/cWiREpUDC4Li/F+fF9CTJ/AZMlDfogExfE:zQu0vsah3D/cWiWp9TdlDwgExc
TLSH
T15EF3E7534BC66719886805FCA8E28D9781848BD089BC3FFAC07194FF9C95926E4EF7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-7-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/4996-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/4996-2-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads