Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-11-2022 00:28
General
-
Target
cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe
-
Size
272KB
-
MD5
555f54e8f462a161e327996503e31735
-
SHA1
486dd61f4d9adc110b32806ebadc73bcfbf262e5
-
SHA256
cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094
-
SHA512
3caa845e16dda17a5a3b1587f4e1f489078aa371371c3f7b0554d1b857d2b7586f1ced38c4d9c570a155043d12be2d97e798c846d151b0ad4706f1dd1635c12e
-
SSDEEP
6144:0j94Szj94Szj94Szj94Szj94Szj94Szj94Szj94Szj9q:0jiSzjiSzjiSzjiSzjiSzjiSzjiSzjiL
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDD0.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF012.bat5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF179.bat7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2B2.bat9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF39C.bat11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF486.bat13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF590.bat15⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"C:\Users\Admin\AppData\Local\Temp\cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094.exe"16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67A.bat17⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD535afc0d9f02874d90d78e25241b285ce
SHA1f9ebe9944533cd4773ceca0992a350b7e4c79f23
SHA256de03cd97c8f1374cfd3f06b2ae76afc269b0d43aa3141124d0b34bec715a673e
SHA512a60f75b379efdaf13a9de2d60eb9728da28b7dcad7d3ec3c9126e94d72cbdbab16d02076396b77275889e4312acd27db8dc8c53eec0da90dfb66488fcca9e041
-
Filesize
722B
MD5554c0d499aadd579807437e2d68db962
SHA1668a33c3a5848c4e386fdf6bf3a25a0cd17ef294
SHA256a68b50661ff915a28bc7b1dbffaf8713b3d28db69854fc44d36976cd2e86d6ea
SHA5120e6741b83d3e1cd3f8e2450f1a000bc6344b8ad7aa25c1aa5c0397499e2a171dd662aac1cfaf1cff556f25c2cf2996c8458b19c09ed945f15ba45e3847e27910
-
Filesize
722B
MD5a9d48e9967af974339880680e8bab619
SHA1ea006f5632d76ff5e51968e68bdf0d6300423138
SHA256d4586bc5b2dcd5ba6799cd2a8c9efa47b02695cbb21e4e3341c6cc009ec66752
SHA51239aa655440b8595450a52c2bfcb11e134feb7ab3be9bf9294aefb0b5d246f48f17e412636635b56f5bce6c8aa7b1b0ae7dbdaba4d0ac255023591e44f0671a1f
-
Filesize
722B
MD53ab605641bb660335ab6e3d734294bfc
SHA135f8314e7db36dfda32b432c02a3330b209b6fae
SHA256519ada6629cbd947b30f5b65d0d5c5f032fdeb0588203123c8173c7840c53cbb
SHA51205459054ad5a48def4820361d9193d7e9a778e99d324ceb116d5cf3a88d33288cb7d637eac13e8b895225af610569042c9b9c65da32e544eb69c08face56d1a0
-
Filesize
722B
MD54878f19ef1da95fb4bc7f6a2c0695777
SHA1896476fa06a8b30601be5e0c5c1879b57d7766a9
SHA2567d5fe748620594a933ecd46ffd260269455ea3ac2f245ddadf6a21c439d25b97
SHA512e9d65e30e8c6f9b288a7b5491812018ffaf1796e946f9e9a0233ae000fda9579b265626886b6ebbdbef176e85f589f2d233787a3408ddf9e85b2537729fd0bc7
-
Filesize
722B
MD538eab0f52343bdb62e954a8c90228b9d
SHA17bf2a3b9af7aa1fea5e71ea38d0e7bd7c149dab0
SHA256ebb15ac1d2bdfb709e948af08b575ed767fced24cfc3251660b6572ee2cb2957
SHA512ebf6fb8b5329e7f8e8d19c20fd7a712403a9d582d9f68f9c87a3c867b309f8cf78ce678c60b24a68051979e3acc422915433dd8e54cada3e59646e74b6657947
-
Filesize
722B
MD5c04fc5da28bb6b53ed97a212224025e8
SHA1d5c120dddcd53f6b05d53cda5ae483428daef666
SHA2566822a3957b74ddd49bfb1e5d00badd0b33e45fae4a00af36193cd87b21460c9c
SHA5122a0222ff715b71acacf0a188b0f7248fc5183629a5bd3a35744de9302ed54886b4a93b0168fd5714d37872b2a61262ea8b2838790f7bb7d49625a5ecd1179e4c
-
Filesize
722B
MD54d371d9a68bc285ff526490cd20663f0
SHA108976b4b82435c806613ea18320a12e9b58fe8a0
SHA256ae0b4521184a1bfed06c7e25b029b550f4a4546f11a2744a1c47265230b80e4e
SHA512b1651e133d6a16e2c32f32f56e35fcd29e2d9a1be3c7e0a938e79b92e7214c9ea737e06be6175557ca7cb504d8866d71107d8d4770b8dcc1de91865eb9de30fc
-
Filesize
239KB
MD5506e0b1599be0bd6e1437d9b7387a89f
SHA18b1d70710f012d5bae0e38f0e364e964ff8cb9d5
SHA256b9e7551f78118817dcfd237fc6afe0da88a77139a99431537ab74adb34b6d12f
SHA5124f5884c503184fe415c5501b514372c07e1bf88222fb6f9b85b61ba471430967f6a8522b4b85dcd4c45f405cea5367658c46ebd10a0935d438d748c86b8ec9b9
-
Filesize
174KB
MD57a723a9440db2ff5291000555b073057
SHA10f5b13d8738682b3ed0d914bfc54bb446cd0279c
SHA2564217d6650caff5042093e8ad53db4e7b699566320a5308679bbee415cb862d34
SHA512c79fae828b29f3fd150ff825a831d1a2ce3f1dfc0548d1bf12c300f9e2a21a64c5d2cae31933e011c8a2a0309586eb995e6e2e9f4e9c0606611369236526dca4
-
Filesize
207KB
MD5646748afd49012efa4f7397830f3503e
SHA132e7fc98fc1710b5532be14a0ac6b731bf518671
SHA256f93c5a60098bb74aa3926dff737831b56f8447c0f783cd24b529a09f2ad82748
SHA512db582ca2c96525d88618514682c987bf8bbdc133318809618002df08c68b1fd356aad884e84bcd4f21656c0ac77916a5531650688d23aea201ca8db1ec4949dd
-
Filesize
109KB
MD58e5d873a5852f0799b41d5832be2b6d8
SHA1ecc557edec7a729cbfb94ced0cd2d6cf043f7fb4
SHA2565983c24fbf3a16417749dd860a8c6f00e5c4c03f8dc53575573e0101feffc40c
SHA512ee51074eadaa9d3eb25aeb1b2255a5f82dbcc64ccc295289e7a15df308998fe9a15095396bfc0ede18d76070f94d0ae8ef55c2c324928b69dff8f8ef6e458b29
-
Filesize
142KB
MD5bf1032e1eb6e5a4e22ccd764d4c51dc2
SHA1f5b4f5e1f399f109602f87ca509b43b9b0385886
SHA25618218b896ab7c7ba2252d4e30d39418cedaee1288f7f4eca46e476ff2d239e0f
SHA5127c554565281810b740331d2080354aa340e55792f83c53ac1c020753ea40967b7091016610851308063a200cf83620e3969231e53ff8f6af7b583a1ab89cbf41
-
Filesize
44KB
MD5075f4f4df936dc55acf0d7d0ea210273
SHA1955df51795b6b1876e3fd0dac7f0972ef030fae7
SHA2561fd0e129c886a5bc3c0c00ac0a222367a0304391d575d31485a0e01028df884c
SHA5129ebd7524d376fa76e7869c2849e79ff6611c6170e240c1833b5e3dd661b4b21a0943abf06e089aad68d675364c1b4bdf5ab8aef4b051b60a7b37fcad8952587e
-
Filesize
77KB
MD5f6a3cdd9af5e5b78e1848a40b741d27c
SHA1eeeee8d1eb2e22b1b8abfa56ac3615deea378975
SHA256623059cebaf78533ccdb1d555d6ec3c1dbb56242be50f14b4a40b09e71075a07
SHA5124f5a3ce0df6cb3f04bc0d2aaaf83a9ca6898fc7ba99cc11a6bb4af5c655fe13c7158d5bd0ca606c2ead448b82a1fae8fb8cbb8d16080ba266a8565b0b49149f3
-
Filesize
239KB
MD5506e0b1599be0bd6e1437d9b7387a89f
SHA18b1d70710f012d5bae0e38f0e364e964ff8cb9d5
SHA256b9e7551f78118817dcfd237fc6afe0da88a77139a99431537ab74adb34b6d12f
SHA5124f5884c503184fe415c5501b514372c07e1bf88222fb6f9b85b61ba471430967f6a8522b4b85dcd4c45f405cea5367658c46ebd10a0935d438d748c86b8ec9b9
-
Filesize
174KB
MD57a723a9440db2ff5291000555b073057
SHA10f5b13d8738682b3ed0d914bfc54bb446cd0279c
SHA2564217d6650caff5042093e8ad53db4e7b699566320a5308679bbee415cb862d34
SHA512c79fae828b29f3fd150ff825a831d1a2ce3f1dfc0548d1bf12c300f9e2a21a64c5d2cae31933e011c8a2a0309586eb995e6e2e9f4e9c0606611369236526dca4
-
Filesize
207KB
MD5646748afd49012efa4f7397830f3503e
SHA132e7fc98fc1710b5532be14a0ac6b731bf518671
SHA256f93c5a60098bb74aa3926dff737831b56f8447c0f783cd24b529a09f2ad82748
SHA512db582ca2c96525d88618514682c987bf8bbdc133318809618002df08c68b1fd356aad884e84bcd4f21656c0ac77916a5531650688d23aea201ca8db1ec4949dd
-
Filesize
109KB
MD58e5d873a5852f0799b41d5832be2b6d8
SHA1ecc557edec7a729cbfb94ced0cd2d6cf043f7fb4
SHA2565983c24fbf3a16417749dd860a8c6f00e5c4c03f8dc53575573e0101feffc40c
SHA512ee51074eadaa9d3eb25aeb1b2255a5f82dbcc64ccc295289e7a15df308998fe9a15095396bfc0ede18d76070f94d0ae8ef55c2c324928b69dff8f8ef6e458b29
-
Filesize
142KB
MD5bf1032e1eb6e5a4e22ccd764d4c51dc2
SHA1f5b4f5e1f399f109602f87ca509b43b9b0385886
SHA25618218b896ab7c7ba2252d4e30d39418cedaee1288f7f4eca46e476ff2d239e0f
SHA5127c554565281810b740331d2080354aa340e55792f83c53ac1c020753ea40967b7091016610851308063a200cf83620e3969231e53ff8f6af7b583a1ab89cbf41
-
Filesize
44KB
MD5075f4f4df936dc55acf0d7d0ea210273
SHA1955df51795b6b1876e3fd0dac7f0972ef030fae7
SHA2561fd0e129c886a5bc3c0c00ac0a222367a0304391d575d31485a0e01028df884c
SHA5129ebd7524d376fa76e7869c2849e79ff6611c6170e240c1833b5e3dd661b4b21a0943abf06e089aad68d675364c1b4bdf5ab8aef4b051b60a7b37fcad8952587e
-
Filesize
77KB
MD5f6a3cdd9af5e5b78e1848a40b741d27c
SHA1eeeee8d1eb2e22b1b8abfa56ac3615deea378975
SHA256623059cebaf78533ccdb1d555d6ec3c1dbb56242be50f14b4a40b09e71075a07
SHA5124f5a3ce0df6cb3f04bc0d2aaaf83a9ca6898fc7ba99cc11a6bb4af5c655fe13c7158d5bd0ca606c2ead448b82a1fae8fb8cbb8d16080ba266a8565b0b49149f3
-
Filesize
12KB
MD53f624c4470fcc43ea32a3185ac40b039
SHA168223d2579aa849bf9098c8930d3af2ababadd6a
SHA256d09a3f3528cc837dd43cf26f6c6c6b94969f63016b84d3bcf05b396508fe7694
SHA51218461bce18c09cd0449f0df9ea584b97c9ae18cf63076188fd4b458d0e2199af4d3ac104207eed0ec663517768d78bf8f91dd4dc9e7197689e0d36a26da3f2c0
-
Filesize
32KB
MD56accfee33d3b8fe43fbba7811415ba5f
SHA1664a962d1f045cc423b549595f5f9bc4b8a5b2b6
SHA2563cb1954dc30b3c929f5f32f518aa0644d603727ea995b7fce56c532448cf54a9
SHA512339226aec74724259556b014fb730026fd3127d05fbd75b9f810c5513ef07a02f9ad0cca8cfdc2e52527fe98b5a768464348e4d39198cea290a1d87517c9c5d8
-
Filesize
32KB
MD56accfee33d3b8fe43fbba7811415ba5f
SHA1664a962d1f045cc423b549595f5f9bc4b8a5b2b6
SHA2563cb1954dc30b3c929f5f32f518aa0644d603727ea995b7fce56c532448cf54a9
SHA512339226aec74724259556b014fb730026fd3127d05fbd75b9f810c5513ef07a02f9ad0cca8cfdc2e52527fe98b5a768464348e4d39198cea290a1d87517c9c5d8
-
Filesize
32KB
MD56accfee33d3b8fe43fbba7811415ba5f
SHA1664a962d1f045cc423b549595f5f9bc4b8a5b2b6
SHA2563cb1954dc30b3c929f5f32f518aa0644d603727ea995b7fce56c532448cf54a9
SHA512339226aec74724259556b014fb730026fd3127d05fbd75b9f810c5513ef07a02f9ad0cca8cfdc2e52527fe98b5a768464348e4d39198cea290a1d87517c9c5d8
-
-
Filesize
272KB
-
-
-
-
Filesize
272KB
-
-
Filesize
272KB
-
-
-
-
-
-
Filesize
272KB
-
-
Filesize
272KB
-
-
Filesize
272KB
-
Filesize
272KB
-
-
-
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
-
Filesize
272KB
-
-