Analysis
-
max time kernel
292s -
max time network
255s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
28-04-2024 10:26
General
-
Target
08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe
-
Size
5.7MB
-
MD5
4e660043e7b682e7e07e512cb1c79681
-
SHA1
f1cb193f47bf5365340857d7d02a69c70dafd0ad
-
SHA256
08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f
-
SHA512
31f03a196a5aca0c8e01c872cd1e1a2f4082d1a588bb9dab04509c079e98fbf175c957647248458f33df63ce662f755a3a5b15ae5057befd32676785791eda69
-
SSDEEP
49152:3BzVPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dr:3/KUgTH2M2m9UMpu1QfLczqssnKSk
Malware Config
Signatures
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6448.bat3⤵
-
C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.exeFilesize
583KB
MD5c6c10472382655406f80eee5f80aadba
SHA101327b740d4181178d585c33aa795f37dd7494de
SHA256f12a8ae432edc459bb5572d314f46fabe296d4c7afb159e8d4dd4726233712f7
SHA5122981616b5a62da41a356f458b2a4b9c6a969097ea7b4e63e356e248fb40659bf1aa5cc870fe7b36cfc652a12742865742f130c8c0892c7cf155cb0c0858b62c0
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
484KB
MD579d4fd1cb70f3844796aa1ea18a238e2
SHA178d207a7de2aeb85eefc185d894b0b7626e1e1f3
SHA256ccaacc3965c1bdfce8cd1e934895a4563dddf082016e56846966c250bed87d5b
SHA5127a0167cbce49f09ea39e490862b8c371eacf8ce3d74d6a6054e7f0e1df4b307019f5adee03603fcb9d4db2b17841cbc9cf129e9480d70b20c266fe82b3979b33
-
C:\Users\Admin\AppData\Local\Temp\$$a6448.batFilesize
722B
MD5125ba21ecdf5b6df8b5d1b1dbdcd83f0
SHA10beeac0f0899d375203366a21271e16fd18bfc19
SHA256dd73b33324e90b5699170fbaa2fef7c0a95f7faded463decff5dc59173caef3d
SHA512756b1f99ad109ddaf5d8310eb6c1c3eae1ea39689456683ec55758bdc1e9ba614e612c04e2eeab5340450e99582699f579b857f8ad4ebb50a02e4bd6a45f68b7
-
C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe.exeFilesize
5.7MB
MD5ba18e99b3e17adb5b029eaebc457dd89
SHA1ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA256f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
SHA5121f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
-
C:\Windows\Logo1_.exeFilesize
39KB
MD5e562a49de2a4fe02528334fb6bab74a7
SHA1f7fe5abfcc74025ccce004838f6691c9b065fda2
SHA256aa959e0bb3f9e45c50b690682cb03b3f8a26bac4e9b2484245b6428d9d41aefd
SHA512a4eabce52bd0a2fec53bfd83eb98e6446717e1ed6f3242e970a055bf2c7c7ea9423235c97c022031ff7fb1b7af0e650f543e932bb962d0e1246c60ca13008df5
-
F:\$RECYCLE.BIN\S-1-5-21-4106386276-4127174233-3637007343-1000\_desktop.iniFilesize
9B
MD5e7957b9f3d9556c996418169821a7993
SHA1b7028de0f91d2e50a8d5f6d23613331a2784a142
SHA25671a21a13d7822776d52d9a6146651dc9155db9f0bfbd978acf43d12dea2a8539
SHA51272bc8552047095449fa4c3c21300183acfc7b33e6ab69c11435542e2862cb9e896bbfdedaeb97ec6edac8ed68220507a302d1ed2217624c97f6e9a83c0d3a285
-
memory/2004-5193-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2004-17-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2004-10-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2004-8330-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2004-8354-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2676-8-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2676-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB