Analysis
-
max time kernel
187s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 00:25
General
-
Target
44918f5646804d33c109cae33cbe3c03e12652153b44ef2ac99be984023329a2.exe
-
Size
220KB
-
MD5
450da2c2e5b909da93aa0ecda8301180
-
SHA1
67c8c34d148c0426a5022c625498f231141b9908
-
SHA256
44918f5646804d33c109cae33cbe3c03e12652153b44ef2ac99be984023329a2
-
SHA512
9937b578f6bc3ec3bc6ee6cfa41ca712cb5fd6aa5f58fc4f00bbbc7e60ecb0547514391ad7696b1fffa6f4d739c66d71116ac3e5f5591f902b933b0f3301b233
-
SSDEEP
3072:pKsSkuJVL1Jw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwT:luJP035iMhL/vGsbTBl2wOsT
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\44918f5646804d33c109cae33cbe3c03e12652153b44ef2ac99be984023329a2.exe"C:\Users\Admin\AppData\Local\Temp\44918f5646804d33c109cae33cbe3c03e12652153b44ef2ac99be984023329a2.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC76.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44918f5646804d33c109cae33cbe3c03e12652153b44ef2ac99be984023329a2.exe"C:\Users\Admin\AppData\Local\Temp\44918f5646804d33c109cae33cbe3c03e12652153b44ef2ac99be984023329a2.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5351cc656bf0f9d2b1dcf101ed15f5438
SHA1c157b1540a6eb94a6f242b3f24c9789d69c5ea7b
SHA256bf7c62d6d1bce1f6348f7513948b2c41fa57832a13cdf7046cf8663b005d964f
SHA5122ff6a2762db395bf07ff9a1dd9519759a70387e043744c7e5696a4d58ec6961034c088431ba16d011087c124f9be042079449350206766d0a7ecce779baa7d84
-
Filesize
191KB
MD58aa98031128ef0c81d34207e3c60d003
SHA1182164292e382455f00349625dd5fd1e41dcc0c8
SHA25652def964142be6891054d2f95256a3b05d66887964fcd66b34abfe32477e8965
SHA5128ba615af6d4cad84c57c20e318d6277e4bc114c07c14b72088c526a01d414fe719a43551582ecbc38bd352979720d182efc1f639c2c3e91c78b180449bcf2c12
-
Filesize
191KB
MD58aa98031128ef0c81d34207e3c60d003
SHA1182164292e382455f00349625dd5fd1e41dcc0c8
SHA25652def964142be6891054d2f95256a3b05d66887964fcd66b34abfe32477e8965
SHA5128ba615af6d4cad84c57c20e318d6277e4bc114c07c14b72088c526a01d414fe719a43551582ecbc38bd352979720d182efc1f639c2c3e91c78b180449bcf2c12
-
Filesize
29KB
MD5beb286dcd8ba1bb38c7d451a2b14bbe0
SHA11378c0a34e75457c8f0eb6c242e35ec3ffb0da5d
SHA2562ec4b5421a1dbe08e9cb7652ebc05052ae63aa4d74aaf482c4d549479877e99a
SHA5122850ab16aa8c5bf6d6a130e188e53561b9d222fb72bf40065b4469bf8385844c92bcfd3386d28529bdb1674b5038b492b802a34c3264dbbfbf3f4c33ac03a5e7
-
Filesize
29KB
MD5beb286dcd8ba1bb38c7d451a2b14bbe0
SHA11378c0a34e75457c8f0eb6c242e35ec3ffb0da5d
SHA2562ec4b5421a1dbe08e9cb7652ebc05052ae63aa4d74aaf482c4d549479877e99a
SHA5122850ab16aa8c5bf6d6a130e188e53561b9d222fb72bf40065b4469bf8385844c92bcfd3386d28529bdb1674b5038b492b802a34c3264dbbfbf3f4c33ac03a5e7
-
Filesize
29KB
MD5beb286dcd8ba1bb38c7d451a2b14bbe0
SHA11378c0a34e75457c8f0eb6c242e35ec3ffb0da5d
SHA2562ec4b5421a1dbe08e9cb7652ebc05052ae63aa4d74aaf482c4d549479877e99a
SHA5122850ab16aa8c5bf6d6a130e188e53561b9d222fb72bf40065b4469bf8385844c92bcfd3386d28529bdb1674b5038b492b802a34c3264dbbfbf3f4c33ac03a5e7
-
Filesize
216KB
-
-
Filesize
216KB
-
Filesize
216KB
-
-
-
-