Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    30-04-2024 22:14

General

  • Target

    a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe

  • Size

    497KB

  • MD5

    9dacbd16c744b80ac18ab1ba7240cbf3

  • SHA1

    b8a3e0dc23ecabe9eb5e3a942d1acf08ad7bcf25

  • SHA256

    a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f

  • SHA512

    ce406b5cb018e81d82be891a1842a257f01fd25fd92308c3ce39a9638b438551d804fe919460de0f090d8a698271fe83f9cd2e73e8768270e506247224760908

  • SSDEEP

    12288:u+azbvb1gL5pRTcAkS/3hzN8qE43fm78V:uBzb+5jcAkSYqyE

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1228
      • C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe
        "C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2608
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a119D.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2776
            • C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe
              "C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe"
              4⤵
              • Executes dropped EXE
              PID:2764
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2888
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2812
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2768
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:3060

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            264KB

            MD5

            266a8decd1271ba104a9fff2eb37568f

            SHA1

            5fae11187d40c55a75f7174e4af12fef3e0a33a9

            SHA256

            25040ab6bb8ee761b351ca816cce03c80530b89aba11824a74326e84277e2aee

            SHA512

            15e0794324d0066c7cef77dc1f48441d2ddfa355a683c3a49cc6ead86399121122a49c449306330796600b7aa46679b20b9797e8e14aa2ef183102bd8dac304e

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            484KB

            MD5

            79d4fd1cb70f3844796aa1ea18a238e2

            SHA1

            78d207a7de2aeb85eefc185d894b0b7626e1e1f3

            SHA256

            ccaacc3965c1bdfce8cd1e934895a4563dddf082016e56846966c250bed87d5b

            SHA512

            7a0167cbce49f09ea39e490862b8c371eacf8ce3d74d6a6054e7f0e1df4b307019f5adee03603fcb9d4db2b17841cbc9cf129e9480d70b20c266fe82b3979b33

          • C:\Users\Admin\AppData\Local\Temp\$$a119D.bat

            Filesize

            722B

            MD5

            63e88ab03d0b43bb45f6d2b49daee99a

            SHA1

            541ac40e625a9498cd27efdf8aa6bfabdad5e4e1

            SHA256

            17bed5e40e3da0a4e806ec50f0726db1633789245c09942fc9406a6b61bc384c

            SHA512

            af67cb4e423497b7752c742e5b6f0ab9797848d706eda78287c15f9362007fa7f9337471540517350afc44df778f914ad0f4890209b6285b079c39f3c4c225ae

          • C:\Users\Admin\AppData\Local\Temp\a46aa5e8af05e1ea85a99fede9d8bd7820f0327aabc68f15a42a5360b58dfb2f.exe.exe

            Filesize

            458KB

            MD5

            619f7135621b50fd1900ff24aade1524

            SHA1

            6c7ea8bbd435163ae3945cbef30ef6b9872a4591

            SHA256

            344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

            SHA512

            2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

          • C:\Windows\Logo1_.exe

            Filesize

            39KB

            MD5

            4ea1c860080808fe13e78caa0034c62b

            SHA1

            59e326df70ba545b4c443b9a4d4d4ecb725a0ede

            SHA256

            fef391543155b7d88565a03cdcb35eb2d9c44b22f3d4af8ef9fd0f48289f6958

            SHA512

            880bf02f0776da8fde359b6f71b05ed11947f507d44e461f23c55dbeabc54ce63325c877fac5dd2d31c5dad3feb0d81bf02f767ac238494ef7ca5c84ec354e6f

          • F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini

            Filesize

            9B

            MD5

            3441ca64b7a268fd1abb0c149aa9e827

            SHA1

            977a6be7624a5ff4ea1de4f422b44b4974c17827

            SHA256

            fafa54a384b4b9bfe970b0e803afe0c0284021acca503892961170d49985dd99

            SHA512

            84d8adce555267049d33544c4402eaa9bb3ff2022fd76cd619e4cb1fd544c5825cd7769065dd525b58e3befd579d3dd11ec2e0032907ff7dd36f83975b5b5848

          • memory/1228-27-0x00000000024B0000-0x00000000024B1000-memory.dmp

            Filesize

            4KB

          • memory/1740-0-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/1740-16-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2816-31-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2816-18-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2816-3342-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2816-4174-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB