b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec

General

Target

b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
Size

227KB
MD5

f38342e05385365051744d9ba2cc8d26
SHA1

1eb90fe25389a3d386b110a4bd754ffc60a3fc02
SHA256

b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec
SHA512

c51395df4d81d3065ff8449de5cb901c538f1fd8790fd16f04aaefeb2b724b0c68027c79f07017926f932386d3b5611d6280e5f92d8472d77e6e10d719b9da96
SSDEEP

6144:PCuJWdeKzC/leySe8AIqpoHbnDns1ND9m:W/VyV8hEoHbI3A

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3020 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exeb70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe

pid process

2080 Logo1_.exe
1268 b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

3020 cmd.exe

pid	process
3020	cmd.exe

pid	process
3020	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\DVD Maker\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

Logo1_.exeb70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe

description	ioc	process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
File created	C:\Windows\Logo1_.exe	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Logo1_.exe

pid	process
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe
2080	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exeLogo1_.execmd.exenet.exe

description	pid	process	target process
PID 2072 wrote to memory of 3020	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	cmd.exe
PID 2072 wrote to memory of 3020	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	cmd.exe
PID 2072 wrote to memory of 3020	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	cmd.exe
PID 2072 wrote to memory of 3020	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	cmd.exe
PID 2072 wrote to memory of 2080	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	Logo1_.exe
PID 2072 wrote to memory of 2080	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	Logo1_.exe
PID 2072 wrote to memory of 2080	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	Logo1_.exe
PID 2072 wrote to memory of 2080	2072	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe	Logo1_.exe
PID 2080 wrote to memory of 2588	2080	Logo1_.exe	net.exe
PID 2080 wrote to memory of 2588	2080	Logo1_.exe	net.exe
PID 2080 wrote to memory of 2588	2080	Logo1_.exe	net.exe
PID 2080 wrote to memory of 2588	2080	Logo1_.exe	net.exe
PID 3020 wrote to memory of 1268	3020	cmd.exe	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
PID 3020 wrote to memory of 1268	3020	cmd.exe	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
PID 3020 wrote to memory of 1268	3020	cmd.exe	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
PID 3020 wrote to memory of 1268	3020	cmd.exe	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
PID 2588 wrote to memory of 2672	2588	net.exe	net1.exe
PID 2588 wrote to memory of 2672	2588	net.exe	net1.exe
PID 2588 wrote to memory of 2672	2588	net.exe	net1.exe
PID 2588 wrote to memory of 2672	2588	net.exe	net1.exe
PID 2080 wrote to memory of 1180	2080	Logo1_.exe	Explorer.EXE
PID 2080 wrote to memory of 1180	2080	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
"C:\Users\Admin\AppData\Local\Temp\b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe"
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1758.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe
"C:\Users\Admin\AppData\Local\Temp\b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe"
4⤵
- Executes dropped EXE
PID:1268

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2672

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
254KB

MD5
3e470de1df977de1b6251d61cefd34c2

SHA1
c1919c8d46d9c95aab8c167b9ee4e6ac6c089a50

SHA256
cb52a481b391828464a9080ac8ed4a4daf3418176822165713179c0706a1ca27

SHA512
6e106f63747243353c7adaa2ee142ee9a260db0dc2b85e4e5c789969a777503c4508f7e7568213689d4cab4235aee0d81f54e4191997f04d1aaeb6577bc751ee

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Filesize
474KB

MD5
6eabc463f8025a7e6e65f38cba22f126

SHA1
3e430ee5ec01c5509ed750b88d3473e7990dfe95

SHA256
cc8da3ecd355b519d81415d279ed037c725ba221bf323d250aa92ee2b2b88ca7

SHA512
c8fde7026ac8633403bbefee4b044457184388fb7343d8c46f5f7f272724227976bf485ea91da49e2a85dd0cfb73f260ac705d8007333dd3e5539fe5ed67e3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a1758.bat
Filesize
722B

MD5
6077eed51b84377b2b2e8f4d9e8a4858

SHA1
bfcb712ab342bbb9092a44303838f51847f46ecc

SHA256
f166f9707da23568e46bb5e9472b69fb87babf7034c592f5d8f0b5a11b5c2fdd

SHA512
5dcf6bdca60430672a831c8279d484c6f65dea4202fc8abc6b6f0e9b2b879b9db8035ae64760602c8160424e356c59dbbad4f2e3d05a70fa175b3c49a7eced43

Download Submit
C:\Users\Admin\AppData\Local\Temp\b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe.exe
Filesize
198KB

MD5
e133c2d85cff4edd7fe8e8f0f8be6cdb

SHA1
b8269209ebb6fe44bc50dab35f97b0ae244701b4

SHA256
6c5e7d9c81a409e67c143cd3aed33bddc3967fa4c9ab3b98560b7d3bf57d093d

SHA512
701b7d1c7e154519d77043f7de09d60c1ff76c95f820fc1c9afca19724efb0847d646686053354156fd4e8a9dab1f29a79d3223f939a3ff1b3613770dc8603b1

Download Submit
C:\Windows\rundl132.exe
Filesize
29KB

MD5
1c30b55853002b4599e0e5fa853f1329

SHA1
4e1ba89200dd04c3d7042024850deadc89a24af0

SHA256
ac0b99689ea0e6b3d5d4892871dd80175ac8e020a4d86217f968a23a608b22d6

SHA512
f475cd99a54db95649ee9ee83badf6eafb2b073867d95cf4482c2c63062df3446fb2044b7c42c924bf13eb955132379af0a25f877353e151f9ef84b66b5dc3cd

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.ini
Filesize
9B

MD5
ef2876ec14bdb3dc085fc3af9311b015

SHA1
68b64b46b1ff0fdc9f009d8fffb8ee87c597fa56

SHA256
ac2a34b4f2d44d19ca4269caf9f4e71cdb0b95ba8eb89ed52c5bc56eeeb1971c

SHA512
c9998caa062ad5b1da853fabb80e88e41d9f96109af89df0309be20469ca8f5be9dd1c08f3c97030e3a487732e82304f60ee2627462e017579da4204bc163c8f

Download Submit
memory/1180-29-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2072-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2072-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-663-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-2574-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-3309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

pid	process
2080	Logo1_.exe
1268	b70b485d235011f52419aad037cb2adaa8f4584206b07ea35137a11907b7c6ec.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads