Overview
overview
3Static
static
3FULL BUILD...er.exe
windows10-2004-x64
1FULL BUILD...er.exe
windows11-ltsc_2024-x64
1build.bat
windows10-2004-x64
3build.bat
windows11-ltsc_2024-x64
3code/driver/valk.sys
windows10-2004-x64
3code/driver/valk.sys
windows11-ltsc_2024-x64
3loader/kir...er.exe
windows10-2004-x64
1loader/kir...er.exe
windows11-ltsc_2024-x64
1tools/BeDaisy.sys
windows10-2004-x64
3tools/BeDaisy.sys
windows11-ltsc_2024-x64
3tools/WdmDiagSvc.sys
windows10-2004-x64
3tools/WdmDiagSvc.sys
windows11-ltsc_2024-x64
3tools/kdmapper.exe
windows10-2004-x64
1tools/kdmapper.exe
windows11-ltsc_2024-x64
1tools/sig_scan.py
windows10-2004-x64
3tools/sig_scan.py
windows11-ltsc_2024-x64
3x64/Releas...re.exe
windows10-2004-x64
1x64/Releas...re.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
FULL BUILD/kirkware_loader.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
FULL BUILD/kirkware_loader.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
build.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
build.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
code/driver/valk.sys
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
code/driver/valk.sys
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
loader/kirkware_loader.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
loader/kirkware_loader.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
tools/BeDaisy.sys
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
tools/BeDaisy.sys
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
tools/WdmDiagSvc.sys
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
tools/WdmDiagSvc.sys
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
tools/kdmapper.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
tools/kdmapper.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
tools/sig_scan.py
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
tools/sig_scan.py
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
x64/Release/kirkware.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
x64/Release/kirkware.exe
Resource
win11ltsc2024-20260911-en
General
- Target tools/kdmapper.exe
- Size 150KB
- Sample261029-ypncfscc86
- SHA256 3d0326be77fd736ee57d9ec3722c1e7be2d7ecfb1b3e56adcc4f055198263d84
- MD5 103349d9ab1968719b2f6f7e8e57b1bf
- SHA1 ec2b4dcc62038becd7dd7458c704ab8df4cd638b
- SHA512 b2315dc066803a7b4c86c05a7d0b71f8d36682da7728c7aef6783895094343b826cea7b88ef6427efff29d81218e2e4e2957cedb18ad1c9e029da2d1f0db6f0f
- SSDEEP 3072:eEQeuLZ8OB7/Uc7sMDcFS0Dzri2kwBmJTQSaMm5/6YjCNHwU3:lgNpBDUc7ncFSQniXJWljuQU
- TLSH T15CE32A5787A9106DF1B7D6B9CAB24911EB717C950B74D2CF135048BA0F227D0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2500 kdmapper.exe 2500 kdmapper.exe