Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 14:15

General

  • Target

    552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232.exe

  • Size

    224KB

  • MD5

    c5e99e9517172376c06c1d1522fb109d

  • SHA1

    f8ab43be3e3859ce7ae05e7d3b9d9c53a5e90325

  • SHA256

    552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232

  • SHA512

    24ef3a3f940860d0e33be027924157fc78ed892e155dacf0d9b06c265368b2dcf2a660032dab8048c13480af462b55f957dcabf2b1bbc1efb20ea5d2c9cd0e26

  • SSDEEP

    3072:/Pe+a+3dN5iJw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwT:++aM0035iMhL/vGsbTBl2wOsT

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232.exe
        "C:\Users\Admin\AppData\Local\Temp\552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3844
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1424
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a417D.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4920
            • C:\Users\Admin\AppData\Local\Temp\552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232.exe
              "C:\Users\Admin\AppData\Local\Temp\552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232.exe"
              4⤵
              • Executes dropped EXE
              PID:5024
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2228
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4460
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:4516
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3352
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2400

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\7-Zip\7z.exe

            Filesize

            577KB

            MD5

            56dff40d6b9bd9c0faa93c001703a62a

            SHA1

            5382f5e3cb2a4a1d952a1a352383b042dba9ce70

            SHA256

            fcdedf720a1d38c2626c8c6541644ceab2fe9fde50fbfa5a9665a1cc6a45091e

            SHA512

            6b239e3df43002e5443a072f3e92f3d1f076ffa1fa51bff2ea0534d2e75febc86a0089f4c9f5797a28ec288a6273128229095cc08230a3f9d352abb19f8acebd

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

            Filesize

            643KB

            MD5

            b06c23c388c6c6a3219fdaf5efaabccf

            SHA1

            ada13c3c4449d222de774ebd037078ba31d33cd2

            SHA256

            8efeb8be3a4ae59e4106e6c1d9e122d8ecb84b71cf01796f27d94ecfe80e0809

            SHA512

            aefc2fbbf660ee465ac7f174ab8f3de242c352d473a02ee96214d29a5e854e88c7ad842685bdb81698c8d51e0b597d7379c3a039e704839be748fe96a68c23b9

          • C:\Users\Admin\AppData\Local\Temp\$$a417D.bat

            Filesize

            722B

            MD5

            da84d5fc8a66bc4e0f601bdec363ea52

            SHA1

            e6fb4154611ca61d016efc7e9a1b25df22c507cd

            SHA256

            a4595c69e87c27c7714373778920747731c98634c1cde93470a7a5d6c7eaae30

            SHA512

            31f501c8c4588695637e476dfb5e32d2ea142263805408572151ec81b59dbb53e5bb7137ef0f521e08ba6102157d6c93f33f1e97c51ec309550e808fabd94317

          • C:\Users\Admin\AppData\Local\Temp\552ac4adca38528389c36c814aa754c59e5f33354abad1dd3417ea823333d232.exe.exe

            Filesize

            191KB

            MD5

            8aa98031128ef0c81d34207e3c60d003

            SHA1

            182164292e382455f00349625dd5fd1e41dcc0c8

            SHA256

            52def964142be6891054d2f95256a3b05d66887964fcd66b34abfe32477e8965

            SHA512

            8ba615af6d4cad84c57c20e318d6277e4bc114c07c14b72088c526a01d414fe719a43551582ecbc38bd352979720d182efc1f639c2c3e91c78b180449bcf2c12

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            f45e6c5efcb60796280b160b181a07dc

            SHA1

            8d175dae2c97edaedeb1693ab2f1b4a9b9d981d4

            SHA256

            7447829ed8519dd4ee03c37defff6d9c5f2bf06e2ae605da9efece0c495f5844

            SHA512

            1165d2d74f5a0dddd6d99f320c4563a1625da3b8125243baee289ce747c1665766e8dcdd6ae259e11efff5b27e572a8f432c3a85260d677874c7e1dbbcf5d088

          • F:\$RECYCLE.BIN\S-1-5-21-1162180587-977231257-2194346871-1000\_desktop.ini

            Filesize

            9B

            MD5

            392ab9dcf5a9daf53626ea1f2e61d0b9

            SHA1

            0a2cdc7f8f9edf33f9fde3f8b90e0020190c8fb7

            SHA256

            9bbc94aad502d7d7a7f502ddb9cbd93b1c89eff13e445971c94ac09215ada67d

            SHA512

            5d1fea63a7793a65dc63c32cfe3ab2e1af941ded8e760f08fbe991e5b30433f86f920d717235a635020740c8f6f7996b4b8e8147e331b29141fcbb7bdc68144d

          • memory/2228-11-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2228-18-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2228-2838-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2228-8694-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/3844-0-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/3844-10-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB