c2a0512c0300624348edae5360c4fc52449dd2b0149c2705d688d3dd0701e4a5

Analysis

user interaction
yes
max time kernel
178s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
korkamk.rar
Size 39.2MB
Sample261113-y1ymkags21
SHA256 c2a0512c0300624348edae5360c4fc52449dd2b0149c2705d688d3dd0701e4a5
MD5 5f72403da77cdd75e3a07593c8af0922
SHA1 f9737da296a58d97a48c5fff374d9ef6f2b28343
SHA512 7390327b8c9a41bdd5e5f0864740cadc684095d4d85e3db190eecc6d5191115ee69102cc7670e593cf0d4415c80c82b4e5b9d34340da4a327e5d2a228066222a
SSDEEP 786432:XL9xZKo3+vwEbgvyHKQOz4MJZjzQ4l111cRl8sknXN6:XLld+v5jHqzPfnxl11126hn96
TLSH
T1FE973347B2BC3051D37E960AE19DC9636F0590B1319E78BF075A3A1F2B5A67C806DCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5220	korkamk.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5220	korkamk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5892	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5892	7zFM.exe
Token: 35	5892	7zFM.exe
Token: SeSecurityPrivilege	5892	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5892	7zFM.exe
5892	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5220	korkamk.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\korkamk.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5892

C:\Users\Admin\Desktop\korkamk.exe
"C:\Users\Admin\Desktop\korkamk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

korkamk.exe

Path C:\Users\Admin\Desktop\korkamk.exe
Size 39.0MB
SHA256 0a64d43aeba0ece0450be43b7ae80358aa3433c15ebf33fac7378e10c1f05e5b
MD5 2728ea7c8d0b615a97fa7bc12a4a2286
SHA1 b58dabce2f5bf3c89deec0b30af8d7fc7aed904c
SHA512 da99cd6d2af058af3117990c9e19839a53608b5d14884db38efe7b3422c29294c9b88ba5bc873f172efb0f885d5b3bb3fa248b22f9b7eb71e8fc00afdef0b36b
SSDEEP 786432:XDSH4uCqM3nqqNWiGPhUsmQPUugGkfk+hvyCl/Lc0Xy+F:XDghF8UbmQ/gZhvyClzca
TLSH
T10B9723E752E562E4C4C30534A68F13D755C064BEC6EE89292AC75C033924DBB8E8EDB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads