Overview
overview
10Static
static
8trojan/1.exe
windows7_x64
10trojan/1.exe
windows10-2004_x64
10trojan/10.exe
windows7_x64
10trojan/10.exe
windows10-2004_x64
8trojan/2.exe
windows7_x64
3trojan/2.exe
windows10-2004_x64
5trojan/3.exe
windows7_x64
10trojan/3.exe
windows10-2004_x64
10trojan/4.exe
windows7_x64
8trojan/4.exe
windows10-2004_x64
8trojan/5.exe
windows7_x64
8trojan/5.exe
windows10-2004_x64
8trojan/6.exe
windows7_x64
10trojan/6.exe
windows10-2004_x64
10trojan/7.exe
windows7_x64
10trojan/7.exe
windows10-2004_x64
10trojan/8.exe
windows7_x64
trojan/8.exe
windows10-2004_x64
10trojan/9.exe
windows7_x64
8trojan/9.exe
windows10-2004_x64
8Analysis
-
max time kernel
185s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 09:24
Static task
static1
Behavioral task
behavioral1
Sample
trojan/1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
trojan/1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
trojan/10.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
trojan/10.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
trojan/2.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
trojan/2.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
trojan/3.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
trojan/3.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
trojan/4.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
trojan/4.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
trojan/5.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
trojan/5.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
trojan/6.exe
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
trojan/6.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
trojan/7.exe
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
trojan/7.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
trojan/8.exe
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
trojan/8.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
trojan/9.exe
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
trojan/9.exe
Resource
win10v2004-20220414-en
General
-
Target
trojan/5.exe
-
Size
1.1MB
-
MD5
1d13e667dbcf6a1ec0d0cacfbf1397ca
-
SHA1
709eaeb8969ac6e3da0bb41348e0369245147d66
-
SHA256
bb7eed4a124277973d985fc52e066f66e075181c337fa61de918a6d1b498ac8e
-
SHA512
a02bbb787e27a1ab25ad8f6bc6c9f6934859027ac23c4427d6385ea75ac0f73ee76853418200055e97b2ad3b2c4be90f19e1fcfd77b4d9cd93491cce4f2b102d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exe5.exepid process 452 Logo1_.exe 3500 5.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\trojan\5.exe.exe upx C:\Users\Admin\AppData\Local\Temp\trojan\5.exe upx behavioral12/memory/3500-143-0x0000000000400000-0x0000000000775000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fil-PH\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uz-Latn-UZ\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x86\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ml-IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\db\bin\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\km-KH\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
5.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe 5.exe File created C:\Windows\Logo1_.exe 5.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Logo1_.exepid process 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe 452 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
5.exeLogo1_.exenet.execmd.exedescription pid process target process PID 3788 wrote to memory of 4724 3788 5.exe cmd.exe PID 3788 wrote to memory of 4724 3788 5.exe cmd.exe PID 3788 wrote to memory of 4724 3788 5.exe cmd.exe PID 3788 wrote to memory of 452 3788 5.exe Logo1_.exe PID 3788 wrote to memory of 452 3788 5.exe Logo1_.exe PID 3788 wrote to memory of 452 3788 5.exe Logo1_.exe PID 452 wrote to memory of 4200 452 Logo1_.exe net.exe PID 452 wrote to memory of 4200 452 Logo1_.exe net.exe PID 452 wrote to memory of 4200 452 Logo1_.exe net.exe PID 4200 wrote to memory of 2632 4200 net.exe net1.exe PID 4200 wrote to memory of 2632 4200 net.exe net1.exe PID 4200 wrote to memory of 2632 4200 net.exe net1.exe PID 4724 wrote to memory of 3500 4724 cmd.exe 5.exe PID 4724 wrote to memory of 3500 4724 cmd.exe 5.exe PID 4724 wrote to memory of 3500 4724 cmd.exe 5.exe PID 452 wrote to memory of 3120 452 Logo1_.exe Explorer.EXE PID 452 wrote to memory of 3120 452 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\trojan\5.exe"C:\Users\Admin\AppData\Local\Temp\trojan\5.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25B8.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\trojan\5.exe"C:\Users\Admin\AppData\Local\Temp\trojan\5.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\$$a25B8.batFilesize
379B
MD5816226bbda273348ee12b2ccd7b2fa17
SHA1f577f3b08d52df5b3b562d1571f737a73ceb5537
SHA2562e4f0363d7fba2061b4c8e1669ae671eabdde7d766c80866094cf11aea73d216
SHA5121e4f2dbc5dcf851032ff45d3d9f4273e134b313dd4dba6f09bbb554e9bddad268bea31c8924f4ce6ce7f2c568b2bc5ba29dd85cec4c0625b449f1bd14bb73798
-
C:\Users\Admin\AppData\Local\Temp\trojan\5.exeFilesize
1.1MB
MD58507edd2a984820273b1649707fac1a1
SHA1436744c85a49d16574324fc9170dc43f9bb28123
SHA2561e15a36a769b697c7e74862b8547808a3908f0c3ff57ba107257d6aac252dbb6
SHA512101a15f48d91f29b82ceba9c3c9ceda07d208802614eea8a130a076324369589420469624b02aee1174a8fc1e0895af5d15df26042368cec3570b8d166fd0ff4
-
C:\Users\Admin\AppData\Local\Temp\trojan\5.exe.exeFilesize
1.1MB
MD58507edd2a984820273b1649707fac1a1
SHA1436744c85a49d16574324fc9170dc43f9bb28123
SHA2561e15a36a769b697c7e74862b8547808a3908f0c3ff57ba107257d6aac252dbb6
SHA512101a15f48d91f29b82ceba9c3c9ceda07d208802614eea8a130a076324369589420469624b02aee1174a8fc1e0895af5d15df26042368cec3570b8d166fd0ff4
-
C:\Windows\Logo1_.exeFilesize
26KB
MD5dc52b29739bc2a3095d04f309def1f2c
SHA195af9562790393d727b5e4f4c33870b95083aa11
SHA25681f6f7c8c07dede2c8bff3f3143eba6ef228b1b9f16a79bc529bc003a56b0ca8
SHA51228c3f848acae11097023ed7cee538b52791f22879279f3e479941a4f7cdd7fcfce013ee15e6b194054ecaf4c50c3a25162a343b92fa02ce21a7816f398f1db94
-
C:\Windows\Logo1_.exeFilesize
26KB
MD5dc52b29739bc2a3095d04f309def1f2c
SHA195af9562790393d727b5e4f4c33870b95083aa11
SHA25681f6f7c8c07dede2c8bff3f3143eba6ef228b1b9f16a79bc529bc003a56b0ca8
SHA51228c3f848acae11097023ed7cee538b52791f22879279f3e479941a4f7cdd7fcfce013ee15e6b194054ecaf4c50c3a25162a343b92fa02ce21a7816f398f1db94
-
C:\Windows\rundl132.exeFilesize
26KB
MD5dc52b29739bc2a3095d04f309def1f2c
SHA195af9562790393d727b5e4f4c33870b95083aa11
SHA25681f6f7c8c07dede2c8bff3f3143eba6ef228b1b9f16a79bc529bc003a56b0ca8
SHA51228c3f848acae11097023ed7cee538b52791f22879279f3e479941a4f7cdd7fcfce013ee15e6b194054ecaf4c50c3a25162a343b92fa02ce21a7816f398f1db94
-
memory/452-145-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/452-132-0x0000000000000000-mapping.dmp
-
memory/452-144-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2632-138-0x0000000000000000-mapping.dmp
-
memory/3500-141-0x0000000000000000-mapping.dmp
-
memory/3500-143-0x0000000000400000-0x0000000000775000-memory.dmpFilesize
3.5MB
-
memory/3788-130-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3788-134-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4200-137-0x0000000000000000-mapping.dmp
-
memory/4724-131-0x0000000000000000-mapping.dmp