fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5

General

Target

fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
Size

56KB
MD5

fc2b57dae8ce84523b3d8f4297e94cf4
SHA1

7a48d1d0faca8a5f430d06db409e8c9ef6c4a769
SHA256

fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5
SHA512

483e836531c9412d23b33f5b102ce7d12034779302e9df6d2b44be92a4f35b56c6e842dc952efdbd58cb6afd76c54db2ebd6882dcebe911f803b4acf38fcc8b8
SSDEEP

768:/qLPcTO5RroZJ76739sBWsNscWlM3dN9N3ZjfPPB8M7A+eK+OJfZFd/bhifLGWrI:/qbSe+Zk78NR3dN5nPBdeK+UfZ/XWrI

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2608 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exefe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe

pid process

2668 Logo1_.exe
2760 fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2608 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2608	cmd.exe

pid	process
2668	Logo1_.exe
2760	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe

pid	process
2608	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\Logo1_.exe	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exeLogo1_.exe

pid	process
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe
2668	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 1952 wrote to memory of 2000	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	net.exe
PID 1952 wrote to memory of 2000	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	net.exe
PID 1952 wrote to memory of 2000	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	net.exe
PID 1952 wrote to memory of 2000	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	net.exe
PID 2000 wrote to memory of 2420	2000	net.exe	net1.exe
PID 2000 wrote to memory of 2420	2000	net.exe	net1.exe
PID 2000 wrote to memory of 2420	2000	net.exe	net1.exe
PID 2000 wrote to memory of 2420	2000	net.exe	net1.exe
PID 1952 wrote to memory of 2608	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	cmd.exe
PID 1952 wrote to memory of 2608	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	cmd.exe
PID 1952 wrote to memory of 2608	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	cmd.exe
PID 1952 wrote to memory of 2608	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	cmd.exe
PID 1952 wrote to memory of 2668	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	Logo1_.exe
PID 1952 wrote to memory of 2668	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	Logo1_.exe
PID 1952 wrote to memory of 2668	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	Logo1_.exe
PID 1952 wrote to memory of 2668	1952	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe	Logo1_.exe
PID 2668 wrote to memory of 2852	2668	Logo1_.exe	net.exe
PID 2668 wrote to memory of 2852	2668	Logo1_.exe	net.exe
PID 2668 wrote to memory of 2852	2668	Logo1_.exe	net.exe
PID 2668 wrote to memory of 2852	2668	Logo1_.exe	net.exe
PID 2852 wrote to memory of 2080	2852	net.exe	net1.exe
PID 2852 wrote to memory of 2080	2852	net.exe	net1.exe
PID 2852 wrote to memory of 2080	2852	net.exe	net1.exe
PID 2852 wrote to memory of 2080	2852	net.exe	net1.exe
PID 2608 wrote to memory of 2760	2608	cmd.exe	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
PID 2608 wrote to memory of 2760	2608	cmd.exe	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
PID 2608 wrote to memory of 2760	2608	cmd.exe	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
PID 2608 wrote to memory of 2760	2608	cmd.exe	fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
PID 2668 wrote to memory of 2812	2668	Logo1_.exe	net.exe
PID 2668 wrote to memory of 2812	2668	Logo1_.exe	net.exe
PID 2668 wrote to memory of 2812	2668	Logo1_.exe	net.exe
PID 2668 wrote to memory of 2812	2668	Logo1_.exe	net.exe
PID 2812 wrote to memory of 2596	2812	net.exe	net1.exe
PID 2812 wrote to memory of 2596	2812	net.exe	net1.exe
PID 2812 wrote to memory of 2596	2812	net.exe	net1.exe
PID 2812 wrote to memory of 2596	2812	net.exe	net1.exe
PID 2668 wrote to memory of 1208	2668	Logo1_.exe	Explorer.EXE
PID 2668 wrote to memory of 1208	2668	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
  "C:\Users\Admin\AppData\Local\Temp\fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2D19.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe
      "C:\Users\Admin\AppData\Local\Temp\fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe"
      4⤵
      Executes dropped EXE
      PID:2760
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2080
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
3e2d3392a9d3ae3ed27661f81e853478

SHA1
fa8c023a3bff75e89ed39f5d4bfb5693d818ca8b

SHA256
09da8a31b7f420b9e4ed6d02e698bcc12a4f3efa46a53d1492a241a5784d44a8

SHA512
27652a29d728b92995b8ce46b150cd14baf5b65789591085ef3fa959dbc99efaa071b7a014ccaabeb6e84cdea642769dc98a7a1684afcda9be82dbb0b8d3fa17

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a2D19.bat

Filesize
722B

MD5
e214791c274ed590297e57dce26832a1

SHA1
15d773017737910211dbc69fd2d345cca050e7d6

SHA256
c1bda940ba1680252766a6b386e54e106473b0d43005007640ec2e8598aaa4be

SHA512
63839067eb8c1c3f19420399de8d3306ae71290e51234e7b417e77a7ba08356fbe5ad23f374e13c2d42e84e4f8576f38b5790fb0a493400e8eab937a5933a05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe4637fc55e4d63255c3b02952a834c069c877aa1dfdde60df1f120c2aa0bef5.exe.exe

Filesize
22KB

MD5
b2f7631fe9ac1f6eb4f276bd7259626c

SHA1
ca1147287b78e3a15d30654a47b37c9aba2b4767

SHA256
23a59a0acd84d07313d6ea78fcf7f629ecdc93ae0c32574c73ef1a467f2831b5

SHA512
aa7e3e9ea219d64c1f9dbca0095968087574dea92e466139c2c8a19d03c1341b53191077504fc07366ceb6bd46323b8f95c454b7a0103e27c939622b0e0a0f6e

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
3659e75ad8a2bdeef5f1d74aae41c2af

SHA1
95b2fa7bc2afbc1f412fc4285dbb6a15cc658a8a

SHA256
dbb4fdb10597cfb189203f72e75a2f2769a6960ed1acc1baa901742a344ae52d

SHA512
f19bbad48af80437f083d21cf89839bee9d30d50162df60a0d7c8205b646739332e55371f5d6c005f69681e41f00df936942c06f94f1a38c25084e438cac61e2

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini

Filesize
9B

MD5
e7957b9f3d9556c996418169821a7993

SHA1
b7028de0f91d2e50a8d5f6d23613331a2784a142

SHA256
71a21a13d7822776d52d9a6146651dc9155db9f0bfbd978acf43d12dea2a8539

SHA512
72bc8552047095449fa4c3c21300183acfc7b33e6ab69c11435542e2862cb9e896bbfdedaeb97ec6edac8ed68220507a302d1ed2217624c97f6e9a83c0d3a285

Download Submit
memory/1208-27-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1952-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1952-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-3318-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-4141-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads