Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
General
-
Target
f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe
-
Size
67KB
-
MD5
c2ae8fcc18b89af6ec47cf95c9b63391
-
SHA1
edf10b48afef041f56323f4ed1b64c4eda910da3
-
SHA256
f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb
-
SHA512
58003d03fe05ba8798f3fcf082683d074dabdda1b87ee7020b7926151e7cc592f5097ca638bf148f0fc589b6e825b9b6dc70c4510b64040aa49e3629b5ce5128
-
SSDEEP
1536:P7aYzMXqtGNttyUn01Q78a4RjZoEV0JuRUFyMOaHQ1l:P7aY46tGNttyJQ7KRek0JXXOeQ
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3728 Logo1_.exe 3824 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{199F2D43-33FB-4870-8FA3-FF69C10363C6}\MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe File created C:\Windows\Logo1_.exe f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3048 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 84 PID 4612 wrote to memory of 3048 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 84 PID 4612 wrote to memory of 3048 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 84 PID 3048 wrote to memory of 1864 3048 net.exe 86 PID 3048 wrote to memory of 1864 3048 net.exe 86 PID 3048 wrote to memory of 1864 3048 net.exe 86 PID 4612 wrote to memory of 3464 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 87 PID 4612 wrote to memory of 3464 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 87 PID 4612 wrote to memory of 3464 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 87 PID 4612 wrote to memory of 3728 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 89 PID 4612 wrote to memory of 3728 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 89 PID 4612 wrote to memory of 3728 4612 f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe 89 PID 3728 wrote to memory of 2660 3728 Logo1_.exe 90 PID 3728 wrote to memory of 2660 3728 Logo1_.exe 90 PID 3728 wrote to memory of 2660 3728 Logo1_.exe 90 PID 2660 wrote to memory of 1176 2660 net.exe 92 PID 2660 wrote to memory of 1176 2660 net.exe 92 PID 2660 wrote to memory of 1176 2660 net.exe 92 PID 3464 wrote to memory of 3824 3464 cmd.exe 93 PID 3464 wrote to memory of 3824 3464 cmd.exe 93 PID 3464 wrote to memory of 3824 3464 cmd.exe 93 PID 3728 wrote to memory of 2104 3728 Logo1_.exe 94 PID 3728 wrote to memory of 2104 3728 Logo1_.exe 94 PID 3728 wrote to memory of 2104 3728 Logo1_.exe 94 PID 2104 wrote to memory of 4112 2104 net.exe 96 PID 2104 wrote to memory of 4112 2104 net.exe 96 PID 2104 wrote to memory of 4112 2104 net.exe 96 PID 3728 wrote to memory of 3512 3728 Logo1_.exe 52 PID 3728 wrote to memory of 3512 3728 Logo1_.exe 52
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe"C:\Users\Admin\AppData\Local\Temp\f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF8.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe"C:\Users\Admin\AppData\Local\Temp\f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe"4⤵
- Executes dropped EXE
PID:3824
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1176
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4112
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD549b578318484c88ca48cdc8d20032c95
SHA1d29b24bf2b17da2204449a0f1329e816bfd75696
SHA25622a5a07d257accc276e5bad16f06b5b3bcc51f6b084f7a31e12ac0b981ba4be2
SHA512e4639e0d030bf63bbc84016fd4ab8e04dcfab856660e7ca917413784fc62b31f466b1b2986d48f2af02ceab574c8c81e5cf679c0a611e434e34849c20ad703b5
-
Filesize
488KB
MD515137620fba9c2013dfa9107be4321d5
SHA131c790632ae19274fc2ed7e1615458324bc199bd
SHA25637cf90de70064c0ecf765ae35e8b0cf412c90cca2aaa2513cfba95b408b4e604
SHA512e2cbb59ec77cb009bf1b0d8d398c0898e65380858d33afb58e6ffc762842526f097d112369200cda95f015f5aa75e5af88810e2f2e174e0d1600cb6ec22a77e3
-
Filesize
721B
MD513df053fc4717c406a96cf8408d81bf8
SHA1d249034c4356a8ab674f078f6cee66f67310960c
SHA2561488089a95313d055445b3d4086a471102adf54aff735a1e845f467fa2b7e438
SHA512cad227f448f221c27f512cf037d97505ab7d7ba1b654209ca12dd2d9eec8ddf7521b32201c013841e3342d0d001d7f9faae5a95221716336773cd7d67a32fe1e
-
C:\Users\Admin\AppData\Local\Temp\f24f471863ce9d420da152cdd6e978a2f35c15d967a2dc7df90ca57205f45ecb.exe.exe
Filesize33KB
MD569b16c7b7746ba5c642fc05b3561fc73
SHA183d80d668dca76b899e1bf662ddee0e0c18ac791
SHA2560deceb6b1b7a2dd1f13133ac7328ff420dad4610cee1fa7466e8e0f6baa39116
SHA5126b8eebcfe5b04141640047fe468371ad02bb115ee9ef00260c0b33cfd56b142c2e01b3b1c6f07281aa57b1f3b9fdb1f1082fe5620f88a57b92d8f547267ef154
-
Filesize
33KB
MD5460d2eb14b1906dd2eb1bd89ff874a90
SHA19baf7c925cf37bb2a8b1dab06b12d3137a031a4f
SHA256a3534a35919bdd243e61a7a1a10aca06013abb9f7ef35640e5962ca5e86e8a8d
SHA512ce3e7de570a1eaa3724928c29143ceefbdde6596beccdbd289586d3ec6d773bc9e0a09ce0b9393d58f0db3dfc25cbecaff4ee405fb85baef821732f51d8f99ce
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD53c5c5bba3a178ced5be3ad498900e558
SHA1d0cd13c835963414049b9a8bab9b576e1fc6f61c
SHA2568f524014a5806ddb9bf3a788def8a4bf384978b9108d9f37607a14b9c08f8c97
SHA512949505ee30a6408d2c7e4ab64a93c1f8f5f21b44e59e5f0d7b22a282ae2e36bf22f44b45b9b9030be8501266cd9895133aaa203301f3d5ec87e26ef583f8c737