537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479

General

Target

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
Size

47KB
MD5

71ee47f249e24c195d23e02d30915fb1
SHA1

cee911d55fafa45f87cd0784912ba2d376921b9b
SHA256

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479
SHA512

9110164c92b8188e48dbaf92dda7a78e9bca618fa94a7436c3b4a4a5ae43c87af54b49f223a010d7d5db7049951ae4fb832ec2c6d511c9c470f6a0e308cc96f4
SSDEEP

768:/IPcTO5RroZJ76739sBWsNscWlM3dN9N3ZjfPPuWQ3655Kv1X/qY1MSd:/wSe+Zk78NR3dN5nPuHqaNrFd

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe

pid process

4080 Logo1_.exe
1016 537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4080	Logo1_.exe
1016	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\Logo1_.exe	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exeLogo1_.exe

pid	process
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe
4080	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 4664 wrote to memory of 4216	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	net.exe
PID 4664 wrote to memory of 4216	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	net.exe
PID 4664 wrote to memory of 4216	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	net.exe
PID 4216 wrote to memory of 3512	4216	net.exe	net1.exe
PID 4216 wrote to memory of 3512	4216	net.exe	net1.exe
PID 4216 wrote to memory of 3512	4216	net.exe	net1.exe
PID 4664 wrote to memory of 3660	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	cmd.exe
PID 4664 wrote to memory of 3660	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	cmd.exe
PID 4664 wrote to memory of 3660	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	cmd.exe
PID 4664 wrote to memory of 4080	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	Logo1_.exe
PID 4664 wrote to memory of 4080	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	Logo1_.exe
PID 4664 wrote to memory of 4080	4664	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe	Logo1_.exe
PID 4080 wrote to memory of 1380	4080	Logo1_.exe	net.exe
PID 4080 wrote to memory of 1380	4080	Logo1_.exe	net.exe
PID 4080 wrote to memory of 1380	4080	Logo1_.exe	net.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 3660 wrote to memory of 1016	3660	cmd.exe	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
PID 3660 wrote to memory of 1016	3660	cmd.exe	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
PID 3660 wrote to memory of 1016	3660	cmd.exe	537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
PID 4080 wrote to memory of 2732	4080	Logo1_.exe	net.exe
PID 4080 wrote to memory of 2732	4080	Logo1_.exe	net.exe
PID 4080 wrote to memory of 2732	4080	Logo1_.exe	net.exe
PID 2732 wrote to memory of 2000	2732	net.exe	net1.exe
PID 2732 wrote to memory of 2000	2732	net.exe	net1.exe
PID 2732 wrote to memory of 2000	2732	net.exe	net1.exe
PID 4080 wrote to memory of 3416	4080	Logo1_.exe	Explorer.EXE
PID 4080 wrote to memory of 3416	4080	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3416

C:\Users\Admin\AppData\Local\Temp\537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
"C:\Users\Admin\AppData\Local\Temp\537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:4216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:3512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4045.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Users\Admin\AppData\Local\Temp\537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe
"C:\Users\Admin\AppData\Local\Temp\537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe"
4⤵
- Executes dropped EXE
PID:1016

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:1768

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
Filesize
251KB

MD5
87463f1c73625d5bd53aea91d70242bf

SHA1
1c957b20a479f7126a535e85702166691fdc6d8a

SHA256
9ea07a334c31a942d7976d736fa5300cc901a13ce4ed6d3d1d2251addc3e083b

SHA512
34989ca31fc53c3b6e98bbb3b39d42999ce6ed62c2a32a1efe3317a2f56f8d4b2650c40abca9885a1dcfb6d111f731f12f5d97ea50e4dacb01f919497cac4eba

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
577KB

MD5
45f6db1ec72be2ae72124871996da724

SHA1
859058aaee81af4e9b64f1e4308d6ec13e53e9d3

SHA256
c720359aeb64cad64544b51dc032579ba42c1ce337ebc58bacb0a8c61092ab5b

SHA512
c41395aa00a4e6d40708a7ace7f4f19c99b13c8f04e296cae41d24721388ec27e1f824e372700754ab7dbbe0d87001fb34c26e3b157e2e4b9e34cf4cc87d9619

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize
643KB

MD5
b06c23c388c6c6a3219fdaf5efaabccf

SHA1
ada13c3c4449d222de774ebd037078ba31d33cd2

SHA256
8efeb8be3a4ae59e4106e6c1d9e122d8ecb84b71cf01796f27d94ecfe80e0809

SHA512
aefc2fbbf660ee465ac7f174ab8f3de242c352d473a02ee96214d29a5e854e88c7ad842685bdb81698c8d51e0b597d7379c3a039e704839be748fe96a68c23b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a4045.bat
Filesize
722B

MD5
1fdb24c35852b2e31852e51ec2c62e30

SHA1
7566c7d6bde6c8cd23cee83e4570bde0d09d473e

SHA256
5edf710dd8f10fbeb30c644825182f962d323ce8066e31edc9040b4bafd352d7

SHA512
4c026849ac73e997636edcb76494f57bd1d6d44368ff6b9bbe92f0e0439065a38f705757a6f7c0906aff0359919bea4f030223a42507e85312d91f9ec93177af

Download Submit
C:\Users\Admin\AppData\Local\Temp\537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479.exe.exe
Filesize
14KB

MD5
ad782ffac62e14e2269bf1379bccbaae

SHA1
9539773b550e902a35764574a2be2d05bc0d8afc

SHA256
1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

SHA512
a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
030c9aac5dcb76c5a06bf0ac2cdecfb0

SHA1
18f137b0ad656c47efffbc845449b5e80294bfd2

SHA256
815990d99ef2e24393dfdaac82ed03ab38096386d327ae3a8f670c63e02dbf79

SHA512
4db5e2a3c0e3d70003437fd15eebe90bb4574450b600bcac0fb52842c646fe5c098912ad479cf3ec4a490c985ba837e37ed5bdeec5db2ca57b16360290e0cce5

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3726321484-1950364574-433157660-1000\_desktop.ini
Filesize
9B

MD5
e7957b9f3d9556c996418169821a7993

SHA1
b7028de0f91d2e50a8d5f6d23613331a2784a142

SHA256
71a21a13d7822776d52d9a6146651dc9155db9f0bfbd978acf43d12dea2a8539

SHA512
72bc8552047095449fa4c3c21300183acfc7b33e6ab69c11435542e2862cb9e896bbfdedaeb97ec6edac8ed68220507a302d1ed2217624c97f6e9a83c0d3a285

Download Submit
memory/4080-11-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4080-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4080-5224-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4080-8775-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4664-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4664-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads