c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e

Analysis

max time kernel
187s
max time network
190s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Size

106KB
MD5

6c55f1cdd2ec67568a8b2e7222951149
SHA1

422c7f0655a7ceff4860b7031efc48dfa4198098
SHA256

c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e
SHA512

8f008b4e928f41d984d9e4acaca2e526422430afa73dda0aa249c8c430cdaf0fd69e97bd70d2bd8949b98023b3d8899171db9242638e8e032a91e6ccd5b46eeb
SSDEEP

1536:27qnkAQtSaoGo5n4iLG0/WM6HGHSaYqemmjxi2uC+ysafJzRKUrawr55WYsf:nCSjGoLpWM6slmjxNu4JBzRKUrag+f

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000012677-75.dat	acprotect
behavioral1/files/0x0008000000012677-76.dat	acprotect

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1664	Logo1_.exe
1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012677-75.dat	upx
behavioral1/files/0x0008000000012677-76.dat	upx
behavioral1/memory/1756-78-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/1756-80-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1380	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
1380	cmd.exe
1380	cmd.exe
1756	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Logo1_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\Startup = "Startup"	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\Srv = "ZHh4fDYjI201aG06ImN+ayNlYiJ8ZHx="	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\SrvUp = "ZHh4fDYjI201aG06ImN+ayNlYiJ8ZHx="	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\ver = "3"	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\DLLName = "sysfldr.dll"	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysfldr.dll	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1756	1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	41

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\RCXEE9C.tmp	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\RCX4E43.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\RCX41A8.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXE930.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\RCX5176.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX4129.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\RCX468C.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
File created	C:\Windows\Logo1_.exe	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe
1664	Logo1_.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1628	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	28
PID 1716 wrote to memory of 1628	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	28
PID 1716 wrote to memory of 1628	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	28
PID 1716 wrote to memory of 1628	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	28
PID 1628 wrote to memory of 1576	1628	net.exe	30
PID 1628 wrote to memory of 1576	1628	net.exe	30
PID 1628 wrote to memory of 1576	1628	net.exe	30
PID 1628 wrote to memory of 1576	1628	net.exe	30
PID 1716 wrote to memory of 1380	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	31
PID 1716 wrote to memory of 1380	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	31
PID 1716 wrote to memory of 1380	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	31
PID 1716 wrote to memory of 1380	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	31
PID 1716 wrote to memory of 1664	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	33
PID 1716 wrote to memory of 1664	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	33
PID 1716 wrote to memory of 1664	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	33
PID 1716 wrote to memory of 1664	1716	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	33
PID 1664 wrote to memory of 1504	1664	Logo1_.exe	34
PID 1664 wrote to memory of 1504	1664	Logo1_.exe	34
PID 1664 wrote to memory of 1504	1664	Logo1_.exe	34
PID 1664 wrote to memory of 1504	1664	Logo1_.exe	34
PID 1380 wrote to memory of 1448	1380	cmd.exe	35
PID 1380 wrote to memory of 1448	1380	cmd.exe	35
PID 1380 wrote to memory of 1448	1380	cmd.exe	35
PID 1380 wrote to memory of 1448	1380	cmd.exe	35
PID 1504 wrote to memory of 332	1504	net.exe	37
PID 1504 wrote to memory of 332	1504	net.exe	37
PID 1504 wrote to memory of 332	1504	net.exe	37
PID 1504 wrote to memory of 332	1504	net.exe	37
PID 1664 wrote to memory of 268	1664	Logo1_.exe	38
PID 1664 wrote to memory of 268	1664	Logo1_.exe	38
PID 1664 wrote to memory of 268	1664	Logo1_.exe	38
PID 1664 wrote to memory of 268	1664	Logo1_.exe	38
PID 268 wrote to memory of 1308	268	net.exe	40
PID 268 wrote to memory of 1308	268	net.exe	40
PID 268 wrote to memory of 1308	268	net.exe	40
PID 268 wrote to memory of 1308	268	net.exe	40
PID 1448 wrote to memory of 1756	1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	41
PID 1448 wrote to memory of 1756	1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	41
PID 1448 wrote to memory of 1756	1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	41
PID 1448 wrote to memory of 1756	1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	41
PID 1448 wrote to memory of 1756	1448	c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe	41
PID 1664 wrote to memory of 1256	1664	Logo1_.exe	14
PID 1664 wrote to memory of 1256	1664	Logo1_.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
  "C:\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a9C02.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe
      "C:\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe"
      4⤵
      Executes dropped EXE
      Modifies WinLogon
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        Loads dropped DLL
        
        PID:1756
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:332
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a9C02.bat

Filesize
722B

MD5
60852ab0efe2d92f2d23a8c38533b900

SHA1
1645da2e9cd9eaae6c850798064893d7d0e85c54

SHA256
f41af76e91fe823fa93caa70d1d46979abd0dbaa8b31a3f57b17cae843d63ab5

SHA512
fb29c52ac6c0f4c2ded5bd8491f03b2a32bbb19dddb5c5b5caaeba174429c427fb791e33484576cd960895a4e6b4dea76b834aacfcf313efeded9ba5ae6fa159

Download Submit
C:\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

Filesize
13KB

MD5
1ea4fe4ad39736382af117487b7a7beb

SHA1
8ef35237d698ffb6934d79e9a1cc6c1d9d0bf853

SHA256
37ebb9e2a2675b32788ffa4c16728c49ccbda7998f3c97b1d2ffe4fc1f15a1e6

SHA512
78848e2f2e68416986ffea3839bc5955b912ddfcc9d259af1bd83006722e0d0404eb3bce78f8c2cfb7a40ac70b73b31078fb4f6d541baa9b4a18726e5a803652

Download Submit
C:\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe.exe

Filesize
13KB

MD5
1ea4fe4ad39736382af117487b7a7beb

SHA1
8ef35237d698ffb6934d79e9a1cc6c1d9d0bf853

SHA256
37ebb9e2a2675b32788ffa4c16728c49ccbda7998f3c97b1d2ffe4fc1f15a1e6

SHA512
78848e2f2e68416986ffea3839bc5955b912ddfcc9d259af1bd83006722e0d0404eb3bce78f8c2cfb7a40ac70b73b31078fb4f6d541baa9b4a18726e5a803652

Download Submit
C:\Windows\Logo1_.exe

Filesize
93KB

MD5
4812c27e497de8c92c4a81863796caae

SHA1
392223229195aff1c13383d87e2650288091cda9

SHA256
b34edb82a325d51d912bdc6fe03bbc17fe7c3bf6a5bf830882197c81ca61b41f

SHA512
949016e5a7fb80df83876cc7d31d71b70cd1c1c7e576eb33de8922c4f724e52f93886f3fdb54538fdb94aafa387203917f4f78590f0e8d14e8b1a3ce24a7787a

Download Submit
C:\Windows\Logo1_.exe

Filesize
93KB

MD5
4812c27e497de8c92c4a81863796caae

SHA1
392223229195aff1c13383d87e2650288091cda9

SHA256
b34edb82a325d51d912bdc6fe03bbc17fe7c3bf6a5bf830882197c81ca61b41f

SHA512
949016e5a7fb80df83876cc7d31d71b70cd1c1c7e576eb33de8922c4f724e52f93886f3fdb54538fdb94aafa387203917f4f78590f0e8d14e8b1a3ce24a7787a

Download Submit
C:\Windows\SysWOW64\sysfldr.dll

Filesize
12KB

MD5
b830ffb0a85b0a5eaef1467d5a591b6c

SHA1
0055719482e5caae2f825c3393e6db4bb4e97c56

SHA256
4488db889c9cb64a0777e178a6421f6521ebed22d00b7813877ce8e0277223d2

SHA512
8fda6024a3bd39566c0cb44c274b87dc0baf6ec35f94c45fc3ce94896df5e0d42efcfaaa42cb502aa0a3e70cfc6fd0a2d9e96ccfc6d8d86ee81050e601fdcf7b

Download Submit
C:\Windows\uninstall\rundl132.exe

Filesize
93KB

MD5
4812c27e497de8c92c4a81863796caae

SHA1
392223229195aff1c13383d87e2650288091cda9

SHA256
b34edb82a325d51d912bdc6fe03bbc17fe7c3bf6a5bf830882197c81ca61b41f

SHA512
949016e5a7fb80df83876cc7d31d71b70cd1c1c7e576eb33de8922c4f724e52f93886f3fdb54538fdb94aafa387203917f4f78590f0e8d14e8b1a3ce24a7787a

Download Submit
\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

Filesize
13KB

MD5
1ea4fe4ad39736382af117487b7a7beb

SHA1
8ef35237d698ffb6934d79e9a1cc6c1d9d0bf853

SHA256
37ebb9e2a2675b32788ffa4c16728c49ccbda7998f3c97b1d2ffe4fc1f15a1e6

SHA512
78848e2f2e68416986ffea3839bc5955b912ddfcc9d259af1bd83006722e0d0404eb3bce78f8c2cfb7a40ac70b73b31078fb4f6d541baa9b4a18726e5a803652

Download Submit
\Users\Admin\AppData\Local\Temp\c45650e5fde32af262f2ab4606998513b70b63850293b51795e190a6a6ac463e.exe

Filesize
13KB

MD5
1ea4fe4ad39736382af117487b7a7beb

SHA1
8ef35237d698ffb6934d79e9a1cc6c1d9d0bf853

SHA256
37ebb9e2a2675b32788ffa4c16728c49ccbda7998f3c97b1d2ffe4fc1f15a1e6

SHA512
78848e2f2e68416986ffea3839bc5955b912ddfcc9d259af1bd83006722e0d0404eb3bce78f8c2cfb7a40ac70b73b31078fb4f6d541baa9b4a18726e5a803652

Download Submit
\Windows\SysWOW64\sysfldr.dll

Filesize
12KB

MD5
b830ffb0a85b0a5eaef1467d5a591b6c

SHA1
0055719482e5caae2f825c3393e6db4bb4e97c56

SHA256
4488db889c9cb64a0777e178a6421f6521ebed22d00b7813877ce8e0277223d2

SHA512
8fda6024a3bd39566c0cb44c274b87dc0baf6ec35f94c45fc3ce94896df5e0d42efcfaaa42cb502aa0a3e70cfc6fd0a2d9e96ccfc6d8d86ee81050e601fdcf7b

Download Submit
memory/1448-67-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1756-72-0x0000000013140000-0x000000001314B000-memory.dmp

Filesize
44KB

Download
memory/1756-77-0x0000000013140000-0x000000001314B000-memory.dmp

Filesize
44KB

Download
memory/1756-78-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1756-80-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download