Analysis
- max time kernel
11s - max time network
49s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2023, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe
Resource
win7-20231023-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe
- Size 1.4MB
- Sample231107-vd25padf68
- SHA256 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c
- MD5 3509a417c2e603173fd8548e7f9bbe26
- SHA1 656f250c81b2b6a48dbefa7dcd473066f38b84f9
- SHA512 ed33dc6660a3ad78f44fe062451dd4b5e658cc90851a9c1f7def8b4245cdd8214313eee2e075008e1f9af5bdd25dba222757c60d3523864d73caf2da92b51234
- SSDEEP 24576:jBJrfUSEptjQ5t+pahr72KHzTIdL5t3r+lguNH:jBpBEr0t+paXTUt6KuJ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3568 Logo1_.exe 3100 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe File created C:\Windows\rundl132.exe e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe 3568 Logo1_.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1684 wrote to memory of 3544 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 87 PID 1684 wrote to memory of 3544 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 87 PID 1684 wrote to memory of 3544 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 87 PID 3544 wrote to memory of 3832 3544 net.exe 89 PID 3544 wrote to memory of 3832 3544 net.exe 89 PID 3544 wrote to memory of 3832 3544 net.exe 89 PID 1684 wrote to memory of 1996 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 92 PID 1684 wrote to memory of 1996 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 92 PID 1684 wrote to memory of 1996 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 92 PID 1684 wrote to memory of 3568 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 93 PID 1684 wrote to memory of 3568 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 93 PID 1684 wrote to memory of 3568 1684 e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe 93 PID 3568 wrote to memory of 2664 3568 Logo1_.exe 94 PID 3568 wrote to memory of 2664 3568 Logo1_.exe 94 PID 3568 wrote to memory of 2664 3568 Logo1_.exe 94 PID 2664 wrote to memory of 5104 2664 net.exe 97 PID 2664 wrote to memory of 5104 2664 net.exe 97 PID 2664 wrote to memory of 5104 2664 net.exe 97 PID 1996 wrote to memory of 3100 1996 cmd.exe 99 PID 1996 wrote to memory of 3100 1996 cmd.exe 99 PID 1996 wrote to memory of 3100 1996 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe"C:\Users\Admin\AppData\Local\Temp\e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵PID:3832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB362.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe"C:\Users\Admin\AppData\Local\Temp\e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe"3⤵
- Executes dropped EXE
PID:3100
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5104
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\$$aB362.bat
- Size 722B
- SHA256 90997ec8154e7a63b6d901c62e1e4f2513e12cd26115412ef3879e1203252b7c
- MD5 50fc85d850d76ac0c96710bc16dccd3a
- SHA1 f22d3562ee759ceb1565139ecb3979f364641262
- SHA512 97c25d575d1becc576114654f04ce2337666bee894dce6028c2e68351b4c761d7b23e819dc82992a954ad6c0cc287ba8f1f9f445f42d706f123ba31a6a6a2e79
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe
- Size 1.4MB
- SHA256 0088e3fe33e46e0f601e8e2b276c53e9bba4a3ce33080440ab9d09fc7f35ee07
- MD5 e7e1c0b980036e7f70c912aecd418647
- SHA1 1ab4e3a41107c57a1a03efe188d6a4d93a03bea2
- SHA512 2267badba79f474ef947ed0cbcff7ace4c0ab29dbd2b3cc93066b6a82d14cda1dc9b967ce3c10623b2d3a4178ff553666c77df69722741e8a6173441f12bf72b
- SSDEEP 24576:PrfUSEptjQ5t+pahr72KHzTIdL5t3r+lguNH:DBEr0t+paXTUt6KuJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\e6abaa32e70a3903ae437be6cd4d2d53b6fe49ece67ce8d149cae67453efe07c.exe.exe
- Size 1.4MB
- SHA256 0088e3fe33e46e0f601e8e2b276c53e9bba4a3ce33080440ab9d09fc7f35ee07
- MD5 e7e1c0b980036e7f70c912aecd418647
- SHA1 1ab4e3a41107c57a1a03efe188d6a4d93a03bea2
- SHA512 2267badba79f474ef947ed0cbcff7ace4c0ab29dbd2b3cc93066b6a82d14cda1dc9b967ce3c10623b2d3a4178ff553666c77df69722741e8a6173441f12bf72b
- SSDEEP 24576:PrfUSEptjQ5t+pahr72KHzTIdL5t3r+lguNH:DBEr0t+paXTUt6KuJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 00d70ab7c9fe60fe6d78f1ca1cff2004420f91a0a0b973f1f5107d39c1087ee7
- MD5 dc13629269f864e2b421bb3500f0861d
- SHA1 d69c72ff1c15b88604fe0c1e6dc297fce821ea77
- SHA512 c5f66786654f728468a2c728cc64c9103b4ea5e3eff261c875c4e4249559631562749f19d2368d7a4ca6edee0a10ffd6facc6dda8944462c74407632dccfef2c
- SSDEEP 768:KMkOZcO5RroZJ76739sBWs69a7zKHOrEz+mKLtOWD:Kpe+Zk78UKUW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 00d70ab7c9fe60fe6d78f1ca1cff2004420f91a0a0b973f1f5107d39c1087ee7
- MD5 dc13629269f864e2b421bb3500f0861d
- SHA1 d69c72ff1c15b88604fe0c1e6dc297fce821ea77
- SHA512 c5f66786654f728468a2c728cc64c9103b4ea5e3eff261c875c4e4249559631562749f19d2368d7a4ca6edee0a10ffd6facc6dda8944462c74407632dccfef2c
- SSDEEP 768:KMkOZcO5RroZJ76739sBWs69a7zKHOrEz+mKLtOWD:Kpe+Zk78UKUW
- MD5 SHA1 SHA512 SSDEEP