Analysis
-
max time kernel
163s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11-10-2023 15:21
General
-
Target
6112028771422c85b77046df3dd573463b642e4c1610a7b5552b528645cba21c.exe
-
Size
3.1MB
-
MD5
0cbe14e9aca0103b29b6f6b588673be9
-
SHA1
f2c96166e1a463af5c2a500b5a213a8ff2a8ff43
-
SHA256
6112028771422c85b77046df3dd573463b642e4c1610a7b5552b528645cba21c
-
SHA512
2711cb899b9c1dda2fedbbc3b500edee9ab27241638392ef5c859d2e59692b81835264a1d427748b2a684878a870efdfa6ef444a20cba9e49906fbd9a78ec89f
-
SSDEEP
49152:W7ukCSbbYstGP3jg6hEXJJ1o9FuHje1cnklfu5A3cP:CkvEJ/cuHjeHu
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6112028771422c85b77046df3dd573463b642e4c1610a7b5552b528645cba21c.exe"C:\Users\Admin\AppData\Local\Temp\6112028771422c85b77046df3dd573463b642e4c1610a7b5552b528645cba21c.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AE3.bat3⤵
-
C:\Users\Admin\AppData\Local\Temp\6112028771422c85b77046df3dd573463b642e4c1610a7b5552b528645cba21c.exe"C:\Users\Admin\AppData\Local\Temp\6112028771422c85b77046df3dd573463b642e4c1610a7b5552b528645cba21c.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
826KB
MD5117528903e355a4344443a41d364ff60
SHA1c2ecf1fefc5e413292f651833b87de4df1e42973
SHA256ae222922bdf99dc58e08580809f60fc570a734d533c9ca663128dd8f2e118339
SHA512b1252b636a627d699c714bf191d767d07e8a82f981448ae65a732cbbb71515a2729a6c3d510d9642d2bdc07e7dd1823a195a13d578c8a87728adf5c48b9f588a
-
Filesize
722B
MD558452d44dc8be2ce507c901fead67a5e
SHA1f9dcd9c6cce187094e22353cf8749bd68db4afb4
SHA2567ccd875ffc7a741dd0674320f5f7f773346d7b2e28edadf42a71a15ae27bc836
SHA51294d6d9876f3793a903c3ecddd9c49854c68b773a011c37fab29028d097f346023c4a24c2f40850413ee7a889f05f13348ff96ba438d6f2eaa8ca55b26b4d486f
-
Filesize
3.1MB
MD5b17fe656921e74ac23534752dedca872
SHA1c322cf96e2dee58f1e3c41cf14ac3d9d5887caf7
SHA2560b7ca2d0761a3725cf7ea652386c3e97cbb97189e09fa4c9607272c371186a8e
SHA5122b11f1e4471c8212593971916d8a50279566a681220b802d7c5935671b93b1a5eb94c076cd57684c48e948faa1529b4c00cf36d18b6fa08536831ffa6b6a4d3b
-
Filesize
3.1MB
MD5b17fe656921e74ac23534752dedca872
SHA1c322cf96e2dee58f1e3c41cf14ac3d9d5887caf7
SHA2560b7ca2d0761a3725cf7ea652386c3e97cbb97189e09fa4c9607272c371186a8e
SHA5122b11f1e4471c8212593971916d8a50279566a681220b802d7c5935671b93b1a5eb94c076cd57684c48e948faa1529b4c00cf36d18b6fa08536831ffa6b6a4d3b
-
Filesize
26KB
MD572ee62aa96d51b3a02f9cfaf30828cd9
SHA16b558f8efffb2126da7bdcc97666231d72468100
SHA25685adecf849ee286858e3d639c57ee0acab6c4bba12f6cc74ea99ed6dc7941918
SHA512af28159202957a1dbde14b276333cef978efb0125e913bf1a6838e22d1873271ccec42f7a7b8293b81d73758545c7aa178a3429ec22744719868eed72da05079
-
Filesize
26KB
MD572ee62aa96d51b3a02f9cfaf30828cd9
SHA16b558f8efffb2126da7bdcc97666231d72468100
SHA25685adecf849ee286858e3d639c57ee0acab6c4bba12f6cc74ea99ed6dc7941918
SHA512af28159202957a1dbde14b276333cef978efb0125e913bf1a6838e22d1873271ccec42f7a7b8293b81d73758545c7aa178a3429ec22744719868eed72da05079
-
Filesize
26KB
MD572ee62aa96d51b3a02f9cfaf30828cd9
SHA16b558f8efffb2126da7bdcc97666231d72468100
SHA25685adecf849ee286858e3d639c57ee0acab6c4bba12f6cc74ea99ed6dc7941918
SHA512af28159202957a1dbde14b276333cef978efb0125e913bf1a6838e22d1873271ccec42f7a7b8293b81d73758545c7aa178a3429ec22744719868eed72da05079
-
Filesize
10B
MD5dbf19ca54500e964528b156763234c1d
SHA105376f86423aec8badf0adbc47887234ac83ef5a
SHA256bfa0ad2e861e2369dc239edf8f62fbe1c4507d877ec2f76e46e48f1e68fdd5ae
SHA512fb8ce1253ad6d3c1b7d970614dbc2d21574576336a490b54a8dc705a3d8637c0669747ba821fb2f4da14d7447dc24607aca988b0cd3bd9fc4d9d5988b4b631d0
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB