Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe
-
Size
167KB
-
MD5
ca906b44524c8c6a6acbadcbd58e8e4b
-
SHA1
1ac0ec167dd08b68c8252005145aa1d9799b450b
-
SHA256
d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c
-
SHA512
63d7f4c0d41d9cad23ddfcc04d8ac7b76970fee33a563451a8bf937db1ec347bff65bc1640589c5711bc5be3d2650fd1bb4e5835095270002cedd3231da7535c
-
SSDEEP
3072:qKtfDwsjPThTYszDH2fkCd80wrsEAfWBNQ+d+SyhYWi1XC11If:BtfDwsjPThT5zL2MCdVfyN1TtWcCo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1076 Logo1_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe File created C:\Windows\virDll.dll Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe 1076 Logo1_.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3504 wrote to memory of 1376 3504 d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe 85 PID 3504 wrote to memory of 1376 3504 d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe 85 PID 3504 wrote to memory of 1376 3504 d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe 85 PID 3504 wrote to memory of 1076 3504 d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe 86 PID 3504 wrote to memory of 1076 3504 d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe 86 PID 3504 wrote to memory of 1076 3504 d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe 86 PID 1076 wrote to memory of 3604 1076 Logo1_.exe 57 PID 1076 wrote to memory of 3604 1076 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe"C:\Users\Admin\AppData\Local\Temp\d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C01.bat3⤵PID:1376
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5793dec82b142716bbda405263aa30966
SHA1cd739ef7e41059319265ca315081db05cc6f9d7b
SHA25692022b75e715b89252a1244236cf89a18b46ef1f1cc15d451ca00d74fd15b638
SHA512e9e8e062a26a18525ff4c63b52840a18ec5d5e247a889a869a2f34979bb83d88282fe630eabf5103e56af4581b70ab14da478de1ed75865ffe3e950500e8ee86
-
Filesize
722B
MD567b9667ccbad23e19912aba0e9515b5a
SHA1690c2458fad92d4d8a81bbcbdb3052913b3be3d2
SHA2565833cde20bc6524c90b6dfdc31eb1f1d0022a1d90878a223c64fa8cb4d3d2049
SHA512b873b922373ec9017107b82000ea1de06060a96b870c76c69a7c9b19b86a0ee68db8d92b026df7f1955dfc49306fd7a6d46f1d8ee4565f474e130b531093366c
-
C:\Users\Admin\AppData\Local\Temp\d17b250f6e76ae9e8ec4067c6b5170cbd7704db874002e5f056fd2a103bc5d8c.exe.exe
Filesize109KB
MD521dd2539e63faea27741f4b071fa8673
SHA186af0d01ac3878ce9ed678ec2137b4714d307256
SHA256b0b4db7c66bdb13ed175df2137c482905e9d82d402135251889602f61fd7dba0
SHA5125f7005322b4f6beadce8aab8ffba3b7e5ca3d9edbde62fcfd4a74972ef731925ea256f1d68a412579486c3c86817c7cdf1b20959412e4a0e8561c7567cbc21fb
-
Filesize
58KB
MD580254d88a6d0e7dd4cadf27173eb6441
SHA1a2675641d291de43e5edce49a845bb2c5440f1a5
SHA2566a1b32b1bca5eaff9215e5159cf40c60ff48e6a72934bbc06c1e1fc7e567a8b3
SHA51297be4946cdc40c36764d0e3d6f611b24c17b29b89d53ca0f47e3c5616149ac09df79fb3f967d5f4a22fb76219661586f6f219bd6de080d9ccfcb5785945536c4