d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
Size

93KB
MD5

4e27d078863260b8c8778406c43cd1a2
SHA1

2981b1ad0293fdccb3cd30d068462c593ec1fcd1
SHA256

d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58
SHA512

541c0caed88569c3c68f1572ff772e8387373940c85f7a6733dd0e872461bfcdd6d971578940b61fe017bc7bc16211b7107843c8397fdc525bfe502435755f61
SSDEEP

1536:haDacx1aeg1vjrI9U/xvyylHB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:hlf9kU08hAWJGSCTBf12Z9

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1604	Logo1_.exe
2892	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
File created	C:\Windows\Logo1_.exe	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe
1604	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4208	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	86
PID 4508 wrote to memory of 4208	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	86
PID 4508 wrote to memory of 4208	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	86
PID 4208 wrote to memory of 4012	4208	net.exe	88
PID 4208 wrote to memory of 4012	4208	net.exe	88
PID 4208 wrote to memory of 4012	4208	net.exe	88
PID 4508 wrote to memory of 1256	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	90
PID 4508 wrote to memory of 1256	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	90
PID 4508 wrote to memory of 1256	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	90
PID 4508 wrote to memory of 1604	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	92
PID 4508 wrote to memory of 1604	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	92
PID 4508 wrote to memory of 1604	4508	d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe	92
PID 1604 wrote to memory of 2512	1604	Logo1_.exe	93
PID 1604 wrote to memory of 2512	1604	Logo1_.exe	93
PID 1604 wrote to memory of 2512	1604	Logo1_.exe	93
PID 2512 wrote to memory of 4536	2512	net.exe	95
PID 2512 wrote to memory of 4536	2512	net.exe	95
PID 2512 wrote to memory of 4536	2512	net.exe	95
PID 1256 wrote to memory of 2892	1256	cmd.exe	96
PID 1256 wrote to memory of 2892	1256	cmd.exe	96
PID 1256 wrote to memory of 2892	1256	cmd.exe	96
PID 1604 wrote to memory of 1640	1604	Logo1_.exe	99
PID 1604 wrote to memory of 1640	1604	Logo1_.exe	99
PID 1604 wrote to memory of 1640	1604	Logo1_.exe	99
PID 1640 wrote to memory of 3468	1640	net.exe	102
PID 1640 wrote to memory of 3468	1640	net.exe	102
PID 1640 wrote to memory of 3468	1640	net.exe	102
PID 1604 wrote to memory of 3236	1604	Logo1_.exe	52
PID 1604 wrote to memory of 3236	1604	Logo1_.exe	52

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3236
- C:\Users\Admin\AppData\Local\Temp\d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
  "C:\Users\Admin\AppData\Local\Temp\d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a691A.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe
      "C:\Users\Admin\AppData\Local\Temp\d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe"
      4⤵
      Executes dropped EXE
      PID:2892
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4536
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
f22e416b9f4aa3e9df08fd672b779d52

SHA1
b7ad57ed263eca1ec0becbf19f68665bf4b2e495

SHA256
a7b037fb202c3d0dc3960d2bb583e574cff1f7e23240c0920210e63f3ff7104b

SHA512
c21c8ef1c72850039e1bfd6c5cb67afb6a0e2513ae295474dcb456a3385619f27ded813c903505f677e7e16ff0829e5a13a9693416c32b2b560c504d911f7edf

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
491KB

MD5
e7042b6de58736090ff27b77f8961328

SHA1
b6e111a5f224dbf981fb5ee7cf8f6691ddd99f47

SHA256
1710fc3ef9cc0f2ee020d05414285a55fc8eee711342f6d84065fb2edd4f7718

SHA512
af40d8202f570fd04f0e425224124a80aef29342ce78c1295c05c1592b15e6de9eff633d640f857e59015315cc079d49225bee5e192b9aaa0df83442ecf625cb

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
44f2a0b82d8247e1cd5a12a40841f9a8

SHA1
f451bd8ba9098bb674624169aa40f0371ba67924

SHA256
056311169bf6ff9bf378a311dbd3c48697ccce39bedac8cb9ddb7da01384127d

SHA512
bd5f7bf6b83c70bd03416a4944f62fdafbcb7907c3321432c831e189e9d4f95a52faefa575de57209fa5c1523ebed5fde8831f6230fc6f23400bbd33e772c219

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a691A.bat

Filesize
722B

MD5
9298ffd7d65f2cfa6f2a520c15ae2e90

SHA1
d358b25aec4be91600b9ac3702f47febe731f1b8

SHA256
4fc9a8064b6a0962c239515c86ef89075a60108c827e416acb9b9c8372348e74

SHA512
77d50fc91c2e76753b34f86ba534595d5541694e92bc6a2655ffcf5960bd52cd9251d8bc5b4870a87a70f0730524ad0c1121e78bcf283a9f3ea987cfc864e06b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe

Filesize
60KB

MD5
ed0fde686788caec4f2cb1ec9c31680c

SHA1
81ae63b87eaa9fa5637835d2122c50953ae19d34

SHA256
e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c

SHA512
d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6d4cda75e853471f2661c44cbf58073f694def7147e4977c4dd774d021f0d58.exe.exe

Filesize
60KB

MD5
ed0fde686788caec4f2cb1ec9c31680c

SHA1
81ae63b87eaa9fa5637835d2122c50953ae19d34

SHA256
e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c

SHA512
d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
82dfcce1f5eb94eedb719987042c07de

SHA1
7e3c8c54b2d4acaba0134076d110826bbb1155d1

SHA256
ac5eb728f714de5a652b0fb0dd8e9bbbb4dd3a43ab98cbc86040954b257f5387

SHA512
6b190ad437af86cbbccad3108feaa51b42ff7fada86ed962dc1fd6aa18003b5f0805d416f2cf8c7e638cf20953ea81fa69186d43c6aca417baaf8af185a2df7c

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
82dfcce1f5eb94eedb719987042c07de

SHA1
7e3c8c54b2d4acaba0134076d110826bbb1155d1

SHA256
ac5eb728f714de5a652b0fb0dd8e9bbbb4dd3a43ab98cbc86040954b257f5387

SHA512
6b190ad437af86cbbccad3108feaa51b42ff7fada86ed962dc1fd6aa18003b5f0805d416f2cf8c7e638cf20953ea81fa69186d43c6aca417baaf8af185a2df7c

Download Submit
C:\Windows\rundl132.exe

Filesize
33KB

MD5
82dfcce1f5eb94eedb719987042c07de

SHA1
7e3c8c54b2d4acaba0134076d110826bbb1155d1

SHA256
ac5eb728f714de5a652b0fb0dd8e9bbbb4dd3a43ab98cbc86040954b257f5387

SHA512
6b190ad437af86cbbccad3108feaa51b42ff7fada86ed962dc1fd6aa18003b5f0805d416f2cf8c7e638cf20953ea81fa69186d43c6aca417baaf8af185a2df7c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2344688013-2965468717-2034126-1000\_desktop.ini

Filesize
9B

MD5
7b55ef79e83deff31c4c16ca44427d3d

SHA1
cd86347713b82993e86355d6937d54d08aef56b0

SHA256
c440aca6a410ba6673250517487032636dbb9a73d8287b312a49867b99b81f46

SHA512
1a53953508d74b22c37a81dec6767624bf7ca04cf1aa45f7b7a447e63f86cf6a469c89444f9f4b9d902899f4a005dbd6fa1a82fc432b6cf84b62ced9d31f512e

Download Submit
memory/1604-32-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-1821-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-1894-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-2223-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-10-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-5737-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1604-8684-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4508-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4508-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download