78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55

General

Target

78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
Size

537KB
MD5

1e770568a61e39f9aa0c8958859e2b50
SHA1

ee91b154d3cc2815a1a828aadcd3b714a0a6a707
SHA256

78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55
SHA512

772a4d25549dd7c4ee50aff743c0572886042bf95aa1940be00bf5101a47ea4ae91b674717c3354138c607fce76b82707fe5fd4625397d6cab3d609640b8a756
SSDEEP

12288:r1m0nzfWIbJjGuXjo6XRmaHzTWz5ndd1agOjH0zaHuNiT3XIizm:r1mUzOIbJjGndWjUzCuNuHIizm

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe

pid process

4924 Logo1_.exe
3600 78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe

pid	process
4924	Logo1_.exe
3600	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe

Drops startup file 2 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.165.21\MicrosoftEdgeComRegisterShellARM64.exe	Logo1_.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\notification_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
File created	C:\Windows\Logo1_.exe	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exeLogo1_.exe

pid	process
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe
4924	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exenet.exeLogo1_.exenet.exenet.execmd.exe

description	pid	process	target process
PID 4660 wrote to memory of 2032	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	net.exe
PID 4660 wrote to memory of 2032	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	net.exe
PID 4660 wrote to memory of 2032	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	net.exe
PID 2032 wrote to memory of 4756	2032	net.exe	net1.exe
PID 2032 wrote to memory of 4756	2032	net.exe	net1.exe
PID 2032 wrote to memory of 4756	2032	net.exe	net1.exe
PID 4660 wrote to memory of 4972	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	cmd.exe
PID 4660 wrote to memory of 4972	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	cmd.exe
PID 4660 wrote to memory of 4972	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	cmd.exe
PID 4660 wrote to memory of 4924	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	Logo1_.exe
PID 4660 wrote to memory of 4924	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	Logo1_.exe
PID 4660 wrote to memory of 4924	4660	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe	Logo1_.exe
PID 4924 wrote to memory of 4836	4924	Logo1_.exe	net.exe
PID 4924 wrote to memory of 4836	4924	Logo1_.exe	net.exe
PID 4924 wrote to memory of 4836	4924	Logo1_.exe	net.exe
PID 4924 wrote to memory of 628	4924	Logo1_.exe	net.exe
PID 4924 wrote to memory of 628	4924	Logo1_.exe	net.exe
PID 4924 wrote to memory of 628	4924	Logo1_.exe	net.exe
PID 4836 wrote to memory of 3908	4836	net.exe	net1.exe
PID 4836 wrote to memory of 3908	4836	net.exe	net1.exe
PID 4836 wrote to memory of 3908	4836	net.exe	net1.exe
PID 628 wrote to memory of 3972	628	net.exe	net1.exe
PID 628 wrote to memory of 3972	628	net.exe	net1.exe
PID 628 wrote to memory of 3972	628	net.exe	net1.exe
PID 4972 wrote to memory of 3600	4972	cmd.exe	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
PID 4972 wrote to memory of 3600	4972	cmd.exe	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
PID 4972 wrote to memory of 3600	4972	cmd.exe	78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
PID 4924 wrote to memory of 3060	4924	Logo1_.exe	Explorer.EXE
PID 4924 wrote to memory of 3060	4924	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
"C:\Users\Admin\AppData\Local\Temp\78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:4756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD68E.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe
"C:\Users\Admin\AppData\Local\Temp\78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe"
4⤵
- Executes dropped EXE
PID:3600

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:3908

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$aD68E.bat

Filesize
722B

MD5
485f03e9680529355c26c0efcb742989

SHA1
a47b4911e3790c80f4b612fce190d0d813314ae3

SHA256
1a5f40dc1b6f956a5bb1fb2bc0a74194c8d35ffe37118d30a6f798ff4744b1fa

SHA512
d747c6d2284642d23068622c8cd9b0e8e625e255b8435a8096b8b0791950092fc8e7b6ff0424ee00b033066013db39271913bbfd97c07263bfe8e4950fa2d394

Download Submit
C:\Users\Admin\AppData\Local\Temp\78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe

Filesize
504KB

MD5
b0e618e37fedfebb9eaa445aba228417

SHA1
bb3ad3af1d3e296e0c2fdea94ca9d2467904011c

SHA256
3511d060a67d2feefb9800a8e26f3da692cd18ee97e5782bce92b04ca7c6d42e

SHA512
7a2890ebb850b37f0bd7e196499e96b7af86a82d9e5a2a2ec06e4b37cb00c3785fa801ac95acd569b9fe351088e48d0027b81b4b5a6bd896fdcf27e3659ef1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\78491034023643647b4983caa902e8e51b853f17931fa72e52f46e3af0fd6b55.exe.exe

Filesize
504KB

MD5
b0e618e37fedfebb9eaa445aba228417

SHA1
bb3ad3af1d3e296e0c2fdea94ca9d2467904011c

SHA256
3511d060a67d2feefb9800a8e26f3da692cd18ee97e5782bce92b04ca7c6d42e

SHA512
7a2890ebb850b37f0bd7e196499e96b7af86a82d9e5a2a2ec06e4b37cb00c3785fa801ac95acd569b9fe351088e48d0027b81b4b5a6bd896fdcf27e3659ef1ee

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
bad9e77116d96b4253fafc95f9e9151a

SHA1
54163e840c68b858e80e97794fbba77fed8ba739

SHA256
96aa286cec5ade5ea725554006db344831dcf34a5dad4eb52981485c4dd2408c

SHA512
633dd9b9635a77f27cb89e522ff6bb5ffa8adb311fa1ac4c5c7d4e4bb7f4157efc8380b19fed8e431a8f2eb79e887bc9c619f7fa1e92f7e7d91b5e9e7b07fb3a

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
bad9e77116d96b4253fafc95f9e9151a

SHA1
54163e840c68b858e80e97794fbba77fed8ba739

SHA256
96aa286cec5ade5ea725554006db344831dcf34a5dad4eb52981485c4dd2408c

SHA512
633dd9b9635a77f27cb89e522ff6bb5ffa8adb311fa1ac4c5c7d4e4bb7f4157efc8380b19fed8e431a8f2eb79e887bc9c619f7fa1e92f7e7d91b5e9e7b07fb3a

Download Submit
C:\Windows\rundl132.exe

Filesize
33KB

MD5
bad9e77116d96b4253fafc95f9e9151a

SHA1
54163e840c68b858e80e97794fbba77fed8ba739

SHA256
96aa286cec5ade5ea725554006db344831dcf34a5dad4eb52981485c4dd2408c

SHA512
633dd9b9635a77f27cb89e522ff6bb5ffa8adb311fa1ac4c5c7d4e4bb7f4157efc8380b19fed8e431a8f2eb79e887bc9c619f7fa1e92f7e7d91b5e9e7b07fb3a

Download Submit
memory/628-143-0x0000000000000000-mapping.dmp

Download
memory/2032-133-0x0000000000000000-mapping.dmp

Download
memory/3600-148-0x0000000000000000-mapping.dmp

Download
memory/3908-144-0x0000000000000000-mapping.dmp

Download
memory/3972-145-0x0000000000000000-mapping.dmp

Download
memory/4660-139-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4660-132-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4756-134-0x0000000000000000-mapping.dmp

Download
memory/4836-140-0x0000000000000000-mapping.dmp

Download
memory/4924-141-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4924-136-0x0000000000000000-mapping.dmp

Download
memory/4924-150-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4972-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads