ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb

General

Target

ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
Size

97KB
MD5

164271a03f2c9df025f44a4eff1ce7d0
SHA1

704aa0f010c29a261eff841232bd058d5405ca66
SHA256

ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb
SHA512

20f65860db29996ef239c6e5ff833d306c50221a16d5ed8a9501425a41b3b7e2802e738982cd39796cc3254d87f6791e7f6f00a4c7a5f2b738702663459c80a8
SSDEEP

1536:rTtaYzMXqtGNtty1yVumRTT0f88qP2CsRdxgwGGCIOunToIfiWdN:rTtaY46tGNtty1pf8l2CHRGgKTBfik

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exeLogo1_.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exeffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe

pid process

376 Logo1_.exe
1876 ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1164 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1164 cmd.exe
1164 cmd.exe

pid	process
376	Logo1_.exe
1876	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe

pid	process
1164	cmd.exe

pid	process
1164	cmd.exe
1164	cmd.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Policies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

Logo1_.exeffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe

description	ioc	process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
File created	C:\Windows\Logo1_.exe	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exeLogo1_.exe

pid	process
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 1528 wrote to memory of 1380	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	net.exe
PID 1528 wrote to memory of 1380	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	net.exe
PID 1528 wrote to memory of 1380	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	net.exe
PID 1528 wrote to memory of 1380	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	net.exe
PID 1380 wrote to memory of 624	1380	net.exe	net1.exe
PID 1380 wrote to memory of 624	1380	net.exe	net1.exe
PID 1380 wrote to memory of 624	1380	net.exe	net1.exe
PID 1380 wrote to memory of 624	1380	net.exe	net1.exe
PID 1528 wrote to memory of 1164	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	cmd.exe
PID 1528 wrote to memory of 1164	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	cmd.exe
PID 1528 wrote to memory of 1164	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	cmd.exe
PID 1528 wrote to memory of 1164	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	cmd.exe
PID 1528 wrote to memory of 376	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	Logo1_.exe
PID 1528 wrote to memory of 376	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	Logo1_.exe
PID 1528 wrote to memory of 376	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	Logo1_.exe
PID 1528 wrote to memory of 376	1528	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe	Logo1_.exe
PID 376 wrote to memory of 1468	376	Logo1_.exe	net.exe
PID 376 wrote to memory of 1468	376	Logo1_.exe	net.exe
PID 376 wrote to memory of 1468	376	Logo1_.exe	net.exe
PID 376 wrote to memory of 1468	376	Logo1_.exe	net.exe
PID 1468 wrote to memory of 1832	1468	net.exe	net1.exe
PID 1468 wrote to memory of 1832	1468	net.exe	net1.exe
PID 1468 wrote to memory of 1832	1468	net.exe	net1.exe
PID 1468 wrote to memory of 1832	1468	net.exe	net1.exe
PID 1164 wrote to memory of 1876	1164	cmd.exe	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
PID 1164 wrote to memory of 1876	1164	cmd.exe	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
PID 1164 wrote to memory of 1876	1164	cmd.exe	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
PID 1164 wrote to memory of 1876	1164	cmd.exe	ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
PID 376 wrote to memory of 916	376	Logo1_.exe	net.exe
PID 376 wrote to memory of 916	376	Logo1_.exe	net.exe
PID 376 wrote to memory of 916	376	Logo1_.exe	net.exe
PID 376 wrote to memory of 916	376	Logo1_.exe	net.exe
PID 916 wrote to memory of 1824	916	net.exe	net1.exe
PID 916 wrote to memory of 1824	916	net.exe	net1.exe
PID 916 wrote to memory of 1824	916	net.exe	net1.exe
PID 916 wrote to memory of 1824	916	net.exe	net1.exe
PID 376 wrote to memory of 1244	376	Logo1_.exe	Explorer.EXE
PID 376 wrote to memory of 1244	376	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
"C:\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:624

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF22C.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
"C:\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe"
4⤵
- Executes dropped EXE
PID:1876

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:1832

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:1824

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$aF22C.bat
Filesize
722B

MD5
6932a0607e65a777ac7067a046e9d6cb

SHA1
80751b30fc1a8049eacf610b87cc1cfb23221c5a

SHA256
147e37eda066403861edb31da950bdfdac0998dcf88393d34de4d498eb584a8b

SHA512
34338c4bfa9e768f991e65091c20eee1418d50d4863c45c0f995a578382e097bb99c7e1ccaea49dff276013245c1fdcc5446e5c86290a6c089a0d3bd912ced66

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
Filesize
64KB

MD5
ae6ce17005c63b7e9bf15a2a21abb315

SHA1
9b6bdfb9d648fa422f54ec07b8c8ea70389c09eb

SHA256
4a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e

SHA512
c883a5f599540d636efc8c0abc05aab7bad0aa1b10ab507f43f18e0fba905a10b94ff2f1ba10ae0fee15cc1b90a165a768dc078fda0ac27474f0eef66f6a11af

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe.exe
Filesize
64KB

MD5
ae6ce17005c63b7e9bf15a2a21abb315

SHA1
9b6bdfb9d648fa422f54ec07b8c8ea70389c09eb

SHA256
4a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e

SHA512
c883a5f599540d636efc8c0abc05aab7bad0aa1b10ab507f43f18e0fba905a10b94ff2f1ba10ae0fee15cc1b90a165a768dc078fda0ac27474f0eef66f6a11af

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
560f6b919b175cc9c8c7428f21da9e66

SHA1
baca555c4a12b50908a5adcef4a3d2bebc7da7ba

SHA256
5964c8953c9114da5f806222bc73c0cebc4ccbe582ae610952c20cc74b7ae875

SHA512
6e1c3e044284a5bd1d361ab41e80cde3fc488d40ab8a9155952153f1564e87a2a0d7abf453dd8d9b1f6f1f5d9f506afe491431f83767aad7e8df2d59db8b69e6

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
560f6b919b175cc9c8c7428f21da9e66

SHA1
baca555c4a12b50908a5adcef4a3d2bebc7da7ba

SHA256
5964c8953c9114da5f806222bc73c0cebc4ccbe582ae610952c20cc74b7ae875

SHA512
6e1c3e044284a5bd1d361ab41e80cde3fc488d40ab8a9155952153f1564e87a2a0d7abf453dd8d9b1f6f1f5d9f506afe491431f83767aad7e8df2d59db8b69e6

Download Submit
C:\Windows\rundl132.exe
Filesize
33KB

MD5
560f6b919b175cc9c8c7428f21da9e66

SHA1
baca555c4a12b50908a5adcef4a3d2bebc7da7ba

SHA256
5964c8953c9114da5f806222bc73c0cebc4ccbe582ae610952c20cc74b7ae875

SHA512
6e1c3e044284a5bd1d361ab41e80cde3fc488d40ab8a9155952153f1564e87a2a0d7abf453dd8d9b1f6f1f5d9f506afe491431f83767aad7e8df2d59db8b69e6

Download Submit
\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
Filesize
64KB

MD5
ae6ce17005c63b7e9bf15a2a21abb315

SHA1
9b6bdfb9d648fa422f54ec07b8c8ea70389c09eb

SHA256
4a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e

SHA512
c883a5f599540d636efc8c0abc05aab7bad0aa1b10ab507f43f18e0fba905a10b94ff2f1ba10ae0fee15cc1b90a165a768dc078fda0ac27474f0eef66f6a11af

Download Submit
\Users\Admin\AppData\Local\Temp\ffe44ba0632afcc57e8864ab2931fae38d4795abfc53f703df9eeab311d525eb.exe
Filesize
64KB

MD5
ae6ce17005c63b7e9bf15a2a21abb315

SHA1
9b6bdfb9d648fa422f54ec07b8c8ea70389c09eb

SHA256
4a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e

SHA512
c883a5f599540d636efc8c0abc05aab7bad0aa1b10ab507f43f18e0fba905a10b94ff2f1ba10ae0fee15cc1b90a165a768dc078fda0ac27474f0eef66f6a11af

Download Submit
memory/376-75-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/376-58-0x0000000000000000-mapping.dmp

Download
memory/376-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/624-56-0x0000000000000000-mapping.dmp

Download
memory/916-73-0x0000000000000000-mapping.dmp

Download
memory/1164-57-0x0000000000000000-mapping.dmp

Download
memory/1380-55-0x0000000000000000-mapping.dmp

Download
memory/1468-62-0x0000000000000000-mapping.dmp

Download
memory/1528-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1528-54-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1824-74-0x0000000000000000-mapping.dmp

Download
memory/1832-63-0x0000000000000000-mapping.dmp

Download
memory/1876-70-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1876-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads