a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93

General

Target

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
Size

121KB
MD5

0a7aa243845b1a597bf3138f0bcb0ce8
SHA1

569d53e28f34d6545baa43e59cc222fa57851ad5
SHA256

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93
SHA512

7876f1b9fff584709f80e511585c42b80a27478ef87edbde63129fdba97641150d3306fc02ee18762333e796736f5bd410b175db4a77a48c1e363feead56ba24
SSDEEP

1536:/BOWsrz8VuJlMXaDuiNik1JCXf3l9izMfUBRq/YxiLvxnjXIRXMMGBkyJMjZROYc:/By8ulMXaKpNf3wRqQxKvxnsRcaC

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exea7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

pid process

1900 Logo1_.exe
1380 a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1896 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1896 cmd.exe
1896 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1900	Logo1_.exe
1380	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

pid	process
1896	cmd.exe

pid	process
1896	cmd.exe
1896	cmd.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\applet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Policies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
File created	C:\Windows\Logo1_.exe	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exeLogo1_.exe

pid	process
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe
1900	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

pid process

1380 a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

pid process

1380 a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

pid	process
1380	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

pid	process
1380	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 1572 wrote to memory of 1448	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	net.exe
PID 1572 wrote to memory of 1448	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	net.exe
PID 1572 wrote to memory of 1448	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	net.exe
PID 1572 wrote to memory of 1448	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	net.exe
PID 1448 wrote to memory of 2012	1448	net.exe	net1.exe
PID 1448 wrote to memory of 2012	1448	net.exe	net1.exe
PID 1448 wrote to memory of 2012	1448	net.exe	net1.exe
PID 1448 wrote to memory of 2012	1448	net.exe	net1.exe
PID 1572 wrote to memory of 1896	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	cmd.exe
PID 1572 wrote to memory of 1896	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	cmd.exe
PID 1572 wrote to memory of 1896	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	cmd.exe
PID 1572 wrote to memory of 1896	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	cmd.exe
PID 1572 wrote to memory of 1900	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	Logo1_.exe
PID 1572 wrote to memory of 1900	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	Logo1_.exe
PID 1572 wrote to memory of 1900	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	Logo1_.exe
PID 1572 wrote to memory of 1900	1572	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe	Logo1_.exe
PID 1900 wrote to memory of 1936	1900	Logo1_.exe	net.exe
PID 1900 wrote to memory of 1936	1900	Logo1_.exe	net.exe
PID 1900 wrote to memory of 1936	1900	Logo1_.exe	net.exe
PID 1900 wrote to memory of 1936	1900	Logo1_.exe	net.exe
PID 1936 wrote to memory of 584	1936	net.exe	net1.exe
PID 1936 wrote to memory of 584	1936	net.exe	net1.exe
PID 1936 wrote to memory of 584	1936	net.exe	net1.exe
PID 1936 wrote to memory of 584	1936	net.exe	net1.exe
PID 1896 wrote to memory of 1380	1896	cmd.exe	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
PID 1896 wrote to memory of 1380	1896	cmd.exe	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
PID 1896 wrote to memory of 1380	1896	cmd.exe	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
PID 1896 wrote to memory of 1380	1896	cmd.exe	a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
PID 1900 wrote to memory of 2016	1900	Logo1_.exe	net.exe
PID 1900 wrote to memory of 2016	1900	Logo1_.exe	net.exe
PID 1900 wrote to memory of 2016	1900	Logo1_.exe	net.exe
PID 1900 wrote to memory of 2016	1900	Logo1_.exe	net.exe
PID 2016 wrote to memory of 1312	2016	net.exe	net1.exe
PID 2016 wrote to memory of 1312	2016	net.exe	net1.exe
PID 2016 wrote to memory of 1312	2016	net.exe	net1.exe
PID 2016 wrote to memory of 1312	2016	net.exe	net1.exe
PID 1900 wrote to memory of 1420	1900	Logo1_.exe	Explorer.EXE
PID 1900 wrote to memory of 1420	1900	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1420

C:\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
"C:\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2BA3.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe
"C:\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe"
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a2BA3.bat

Filesize
722B

MD5
d29c8e077010bcc32c8f92eb284fbd0d

SHA1
0ed5f0cad86b430be1f948298b57efca560d06e1

SHA256
6236f6808c8750fe642594f9a4a261d69caffcc289eb27234153e22260fa2b90

SHA512
5d2042d2ede43053cce25e653cdc58878894ff892b46d7b8f99d61c826816cdd2f4bc1bb72692dd80e69ca3c79b2613fc7975595c68a862e496a61a0e04ad9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

Filesize
88KB

MD5
9f480ae6157a5f6494343702163f9ed1

SHA1
65fed913b986aaa19e4287bee72170f4e3bc71e4

SHA256
573ef3707a5a7fd58dd7e529c1a9f19d1e5f2f68df1be157080bc830e8a3d97d

SHA512
ca20f65fdfc080e4b9a7cd786ba8cd174dd651469d758c94f82661f213faec3dd772f0f843dee6e72c7b78ffd99c5deacccc11f0bd93c924909aa1fe77f8831d

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe.exe

Filesize
88KB

MD5
9f480ae6157a5f6494343702163f9ed1

SHA1
65fed913b986aaa19e4287bee72170f4e3bc71e4

SHA256
573ef3707a5a7fd58dd7e529c1a9f19d1e5f2f68df1be157080bc830e8a3d97d

SHA512
ca20f65fdfc080e4b9a7cd786ba8cd174dd651469d758c94f82661f213faec3dd772f0f843dee6e72c7b78ffd99c5deacccc11f0bd93c924909aa1fe77f8831d

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
ad4e1f196d99d83c49c257ab73bb1855

SHA1
708a4e77f88d7e213a222b7fde846e40e6856f19

SHA256
34275a61352ae40d6fb0c53e44167cfc9448bc12911f8744673196f166f6c954

SHA512
53426a0e706ac62d919265e7e24d59a7ddb0f43a2ec7c12ec3e08042accabdc105c8e83f803c1d74cc08ef42e8eae192e382eb5ecea58414a0767c2d1112a350

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
ad4e1f196d99d83c49c257ab73bb1855

SHA1
708a4e77f88d7e213a222b7fde846e40e6856f19

SHA256
34275a61352ae40d6fb0c53e44167cfc9448bc12911f8744673196f166f6c954

SHA512
53426a0e706ac62d919265e7e24d59a7ddb0f43a2ec7c12ec3e08042accabdc105c8e83f803c1d74cc08ef42e8eae192e382eb5ecea58414a0767c2d1112a350

Download Submit
C:\Windows\rundl132.exe

Filesize
33KB

MD5
ad4e1f196d99d83c49c257ab73bb1855

SHA1
708a4e77f88d7e213a222b7fde846e40e6856f19

SHA256
34275a61352ae40d6fb0c53e44167cfc9448bc12911f8744673196f166f6c954

SHA512
53426a0e706ac62d919265e7e24d59a7ddb0f43a2ec7c12ec3e08042accabdc105c8e83f803c1d74cc08ef42e8eae192e382eb5ecea58414a0767c2d1112a350

Download Submit
\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

Filesize
88KB

MD5
9f480ae6157a5f6494343702163f9ed1

SHA1
65fed913b986aaa19e4287bee72170f4e3bc71e4

SHA256
573ef3707a5a7fd58dd7e529c1a9f19d1e5f2f68df1be157080bc830e8a3d97d

SHA512
ca20f65fdfc080e4b9a7cd786ba8cd174dd651469d758c94f82661f213faec3dd772f0f843dee6e72c7b78ffd99c5deacccc11f0bd93c924909aa1fe77f8831d

Download Submit
\Users\Admin\AppData\Local\Temp\a7f21ecf4cf7f47ce4118cea14377db5f850eb86681c6ef31a85ef923071cb93.exe

Filesize
88KB

MD5
9f480ae6157a5f6494343702163f9ed1

SHA1
65fed913b986aaa19e4287bee72170f4e3bc71e4

SHA256
573ef3707a5a7fd58dd7e529c1a9f19d1e5f2f68df1be157080bc830e8a3d97d

SHA512
ca20f65fdfc080e4b9a7cd786ba8cd174dd651469d758c94f82661f213faec3dd772f0f843dee6e72c7b78ffd99c5deacccc11f0bd93c924909aa1fe77f8831d

Download Submit
memory/584-66-0x0000000000000000-mapping.dmp

Download
memory/1312-74-0x0000000000000000-mapping.dmp

Download
memory/1380-75-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1380-71-0x0000000000000000-mapping.dmp

Download
memory/1448-55-0x0000000000000000-mapping.dmp

Download
memory/1572-54-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1572-62-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1572-59-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/1896-57-0x0000000000000000-mapping.dmp

Download
memory/1900-67-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1900-60-0x0000000000000000-mapping.dmp

Download
memory/1900-77-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1936-64-0x0000000000000000-mapping.dmp

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download
memory/2016-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads