Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 14:21

General

  • Target

    947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013.exe

  • Size

    58KB

  • MD5

    8ace9bbfe7e0baad5972d722b33654f5

  • SHA1

    f91a7e9e59370b31cc8a77c6e2bda50844304a85

  • SHA256

    947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013

  • SHA512

    a79fdfaff680fd0aca3a0181412d956fb2aa3d35f64dc63960955b83d5bedf0a9cdd0daaa8dd9a02232a04f8176e864b173e786128a2ac6fd4776b8d496c59ad

  • SSDEEP

    1536:PqsaYzMXqtGNttyUn01Q78a4RVvOnl6vAOxJ0lM:PqsaY46tGNttyJQ7KRVGlIAOxJV

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013.exe
        "C:\Users\Admin\AppData\Local\Temp\947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1976
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2A5B.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Users\Admin\AppData\Local\Temp\947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013.exe
              "C:\Users\Admin\AppData\Local\Temp\947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013.exe"
              4⤵
              • Executes dropped EXE
              PID:2284
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2716
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2456
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2432

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            b9ce17b2ca80fc031580509d0fdf5449

            SHA1

            487898f96ee8542ab8486ebae3d98e3369c44e22

            SHA256

            3ee112a1f71030e3d330f5e4f89417d250aa7dfbf1ee4cf08e1f1923a7b3ef44

            SHA512

            9e3fdf38c71c9acf54b30abbaa9ca4db5931be1f911e2ea786ab1d1ccdae0fc123b24a6fd12e6eb773b3cae9af7a6d53751172de207c43e180c87456af154e6e

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            e93193856beaecee9905e2a6f36be17f

            SHA1

            d4c267ea34f28f048e29461656984aad70912eda

            SHA256

            1d345f4e09acdbc12e63ce90d0bd373b56d50a378f4603d8425f6df815e44a7b

            SHA512

            1fbe9c0e86ad98d6a2a7924badec0fffc69a7d0a4839e8af45d0aedf1e4e24a4a798df0ec5b8d0aa6e0e566c0c83a4030549bd32b9ac27406fc772d4a2ff5fc3

          • C:\Users\Admin\AppData\Local\Temp\$$a2A5B.bat

            Filesize

            722B

            MD5

            258b5062066be3ecc671c413a31eede0

            SHA1

            7a04583d78e700a52678cba8aeffd148efdb2f63

            SHA256

            8d879e324f2e076804a30b4449b3a6ce48c66b5def042cc0f1e57a612943b418

            SHA512

            eeca50eb502e2e5b0dc636ab1bf1d369d45be1f610d35f33f6348466de1ebedbaca877cf5d12fecd95988101be1d1fa014fab79efa9b59beeb3709bd3e788eba

          • C:\Users\Admin\AppData\Local\Temp\947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013.exe.exe

            Filesize

            25KB

            MD5

            6ff84be315cfafbbdf36aa01af8389e7

            SHA1

            2c550a4059ac331f5f5c9d3f218e0f6184aa27c9

            SHA256

            47c67c1c88ceaee3cf1667bf956a3e11a84dea2f7c2afc634777aa5f1bf65c76

            SHA512

            72498b009573a9cc9b5554e61d56b68f273682bfa2e13808f4abd5b2171aa59dd4a64bd9f68a3a416cfaceacb0041df918d8a84f28a5fa7f204fc562c5b6b174

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            548b59c56dea702c153092f3c9befd52

            SHA1

            77d37ef5a746ee53d8b7c3ae82c4d2eca3e05d08

            SHA256

            e67be4ca1372399b73443f6f60c634806266796a0c84a22a55fa0080eca30b3f

            SHA512

            0ada1c693a1a40ff9d5407b633a4571268830bfd7edfa7bea370c96675a73269c4861c1c19a7ed478b42e95a91bceb386ce90bd7601cee4ca1076976d00e2e7c

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            832B

            MD5

            7e3a0edd0c6cd8316f4b6c159d5167a1

            SHA1

            753428b4736ffb2c9e3eb50f89255b212768c55a

            SHA256

            1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

            SHA512

            9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

          • F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.ini

            Filesize

            8B

            MD5

            1b16d2dbd4281ce4e4e5729c608dcb0b

            SHA1

            851e624080ba5598edb808d4b30fe2d74999ce18

            SHA256

            c9e46fb51d0588ca1e48ca66731e11992770b9b74a982f9bdbb6ce5b5b75d549

            SHA512

            cd1c4cf7c7871cb48ce735226b25f689b340037e6c992441e566161de7fca7410762d1a0c2670ee4b6546f7ee854d3219e0e2315c3e0387d9bbe3f08076b5a59

          • memory/1196-30-0x0000000002570000-0x0000000002571000-memory.dmp

            Filesize

            4KB

          • memory/2792-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2792-18-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2812-33-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2812-19-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2812-3281-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2812-4105-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB