Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b495ad8edaf6f8da1c38437a3d6c44c8.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
b495ad8edaf6f8da1c38437a3d6c44c8.exe
-
Size
72KB
-
MD5
b495ad8edaf6f8da1c38437a3d6c44c8
-
SHA1
1e98a8dc9421eae40037421bc332f86b224a5a39
-
SHA256
ddd235cb2286fbf73341cfe720fce3b7616c1fd4f5b71dae23e3f5a08d4fb1ce
-
SHA512
8036e3d4edf0d4f928498c354e49615bb3c70667ea8004ff84a9002ad7553237386e3d467f7f3588d084f9824996b6468a018c8af09f4a33aeea1e63703c5659
-
SSDEEP
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitVVXC3adCA:qKtfDwsjPThTYszDH2fRCK7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3068 Logo1_.exe 2008 b495ad8edaf6f8da1c38437a3d6c44c8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{2F27E72A-1D03-48D7-A82A-4D2DEBBDE231}\MicrosoftEdgeUpdateSetup_X86_1.3.185.17.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_127765\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe b495ad8edaf6f8da1c38437a3d6c44c8.exe File created C:\Windows\virDll.dll Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe 3068 Logo1_.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2656 wrote to memory of 4108 2656 b495ad8edaf6f8da1c38437a3d6c44c8.exe 87 PID 2656 wrote to memory of 4108 2656 b495ad8edaf6f8da1c38437a3d6c44c8.exe 87 PID 2656 wrote to memory of 4108 2656 b495ad8edaf6f8da1c38437a3d6c44c8.exe 87 PID 2656 wrote to memory of 3068 2656 b495ad8edaf6f8da1c38437a3d6c44c8.exe 88 PID 2656 wrote to memory of 3068 2656 b495ad8edaf6f8da1c38437a3d6c44c8.exe 88 PID 2656 wrote to memory of 3068 2656 b495ad8edaf6f8da1c38437a3d6c44c8.exe 88 PID 3068 wrote to memory of 3464 3068 Logo1_.exe 56 PID 3068 wrote to memory of 3464 3068 Logo1_.exe 56 PID 4108 wrote to memory of 2008 4108 cmd.exe 90 PID 4108 wrote to memory of 2008 4108 cmd.exe 90 PID 4108 wrote to memory of 2008 4108 cmd.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\b495ad8edaf6f8da1c38437a3d6c44c8.exe"C:\Users\Admin\AppData\Local\Temp\b495ad8edaf6f8da1c38437a3d6c44c8.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6206.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\b495ad8edaf6f8da1c38437a3d6c44c8.exe"C:\Users\Admin\AppData\Local\Temp\b495ad8edaf6f8da1c38437a3d6c44c8.exe"4⤵
- Executes dropped EXE
PID:2008
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989KB
MD5732c54cb40e7d6e8298904e046fd5d11
SHA160f974a5ea0417375ed7aa974f365070deb5f612
SHA256d44e1ba4f2d4ca8d0df9fec05198553f31565dcf0e667c4613aa06fc6b0a9dfb
SHA512621b95932132ba72a4dbbc9c874118470cca2c4dea7749840935f562fb9fdfaa76ee6f171ad2096dd913f3dd9c494146e4c4dfb20fe4f4bc1d71ba5de299f222
-
Filesize
530B
MD527ad6b16a939545d4fc57e5d5581e730
SHA1d1d406e00468a716763d2244d5f669511c3a7544
SHA2568f1b4cb250af32701dd14df0c7490105b2a8023018d85430a475a9fdec7b3ca8
SHA512a68e573e3aecdd87d45f224b53d46e8c6683bfd0bc600b794850fa88cc96fb3754de8fc362b1ecb2e15650fab304e787e50d966c5057f1c076cbb6f8b5fa3e9b
-
Filesize
14KB
MD524ef7650a464eb95f8a5bba03202a9ef
SHA1fd6e36e45fda812ec49eb9a07ce8a6a2ed6cb70c
SHA256290a6c952a8216276bea217b1de6a0e8e3150083fe3b441f3784acac02c77f51
SHA5126402433d125f7e6b8478f2a06fa03e547adc95b18a6426324cbedb39a94ace3e7aa1605b3391b8cb0cf93cddfbc2eaecf781001e915f1546b9492bdebcae64db
-
Filesize
58KB
MD55f37f663a4fa45d381d07638032d024c
SHA1ee3f57a5b28850c4ab25758174faca9ea1af40bd
SHA256bdb0ef4eab81fe0e8d164e94ff78fea2c33a9578a9d8f0cf655240a2215c38ba
SHA512fc6c77edf8bc56484ecb5354240bb9202a536fdb34596b6c1392641be4e762fba5dbe5e325f255d76566b5716684246fc75518c2bb29ea2235ff5a3f1f995485