7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b

General

Target

7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
Size

2.8MB
MD5

e6737de792b148398d431a35df459179
SHA1

50426fa035ffd1799f4fd942f40673869700e647
SHA256

7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b
SHA512

1671da6be15c09a065c5a57e9d3d966e64a6843ce5794a0b7ff7317adc0328f30741facfd9c026a983b462e01987136b5069f05ec7c608fa10c2fec01887f6ce
SSDEEP

49152:ZBj6gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:Zcd1XdhBiiMa7

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2700 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe

pid process

2712 Logo1_.exe
304 7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2700 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2700	cmd.exe

pid	process
2712	Logo1_.exe
304	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe

pid	process
2700	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Install\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
File created	C:\Windows\Logo1_.exe	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exeLogo1_.exe

pid	process
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe
2712	Logo1_.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exenet.exeLogo1_.exenet.exenet.exe

description	pid	process	target process
PID 2424 wrote to memory of 2060	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	net.exe
PID 2424 wrote to memory of 2060	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	net.exe
PID 2424 wrote to memory of 2060	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	net.exe
PID 2424 wrote to memory of 2060	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	net.exe
PID 2060 wrote to memory of 1724	2060	net.exe	net1.exe
PID 2060 wrote to memory of 1724	2060	net.exe	net1.exe
PID 2060 wrote to memory of 1724	2060	net.exe	net1.exe
PID 2060 wrote to memory of 1724	2060	net.exe	net1.exe
PID 2424 wrote to memory of 2700	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	cmd.exe
PID 2424 wrote to memory of 2700	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	cmd.exe
PID 2424 wrote to memory of 2700	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	cmd.exe
PID 2424 wrote to memory of 2700	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	cmd.exe
PID 2424 wrote to memory of 2712	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	Logo1_.exe
PID 2424 wrote to memory of 2712	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	Logo1_.exe
PID 2424 wrote to memory of 2712	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	Logo1_.exe
PID 2424 wrote to memory of 2712	2424	7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe	Logo1_.exe
PID 2712 wrote to memory of 2740	2712	Logo1_.exe	net.exe
PID 2712 wrote to memory of 2740	2712	Logo1_.exe	net.exe
PID 2712 wrote to memory of 2740	2712	Logo1_.exe	net.exe
PID 2712 wrote to memory of 2740	2712	Logo1_.exe	net.exe
PID 2740 wrote to memory of 2672	2740	net.exe	net1.exe
PID 2740 wrote to memory of 2672	2740	net.exe	net1.exe
PID 2740 wrote to memory of 2672	2740	net.exe	net1.exe
PID 2740 wrote to memory of 2672	2740	net.exe	net1.exe
PID 2712 wrote to memory of 2728	2712	Logo1_.exe	net.exe
PID 2712 wrote to memory of 2728	2712	Logo1_.exe	net.exe
PID 2712 wrote to memory of 2728	2712	Logo1_.exe	net.exe
PID 2712 wrote to memory of 2728	2712	Logo1_.exe	net.exe
PID 2728 wrote to memory of 2504	2728	net.exe	net1.exe
PID 2728 wrote to memory of 2504	2728	net.exe	net1.exe
PID 2728 wrote to memory of 2504	2728	net.exe	net1.exe
PID 2728 wrote to memory of 2504	2728	net.exe	net1.exe
PID 2712 wrote to memory of 1188	2712	Logo1_.exe	Explorer.EXE
PID 2712 wrote to memory of 1188	2712	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
"C:\Users\Admin\AppData\Local\Temp\7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a140D.bat
3⤵
- Deletes itself
- Loads dropped DLL
PID:2700

C:\Users\Admin\AppData\Local\Temp\7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe
"C:\Users\Admin\AppData\Local\Temp\7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe"
4⤵
- Executes dropped EXE
PID:304

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2672

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2504

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
258KB

MD5
66e8e5e27c1381d4a898f45b90ac0eba

SHA1
c17a94464d95704b92247194b7bc9131d005c8c2

SHA256
82c99d82aef2b72a19ea31d310e6e4c07a0a694cc347b2391748e0b4dcbed630

SHA512
fbe9253e7fa154aef33552884c80c8125c7d203b3b52445a596a4c94e195ff5c67f9b8beac9dec502ea9ee690c4d296a5ed2801a01296c7138ca166be1f8c854

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Filesize
478KB

MD5
3e2d3392a9d3ae3ed27661f81e853478

SHA1
fa8c023a3bff75e89ed39f5d4bfb5693d818ca8b

SHA256
09da8a31b7f420b9e4ed6d02e698bcc12a4f3efa46a53d1492a241a5784d44a8

SHA512
27652a29d728b92995b8ce46b150cd14baf5b65789591085ef3fa959dbc99efaa071b7a014ccaabeb6e84cdea642769dc98a7a1684afcda9be82dbb0b8d3fa17

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a140D.bat
Filesize
722B

MD5
a8fdb23cd20c209f4e1236569d980bbd

SHA1
65b2a78ac50773991cb02ccc2ccc6baca4004fa1

SHA256
62dbf1df23cd90e00de2568dfe2a18449e017f794601827bd05cf666d49ff18c

SHA512
285300d1ff24ff9f667064f822a3acaf9368b6ef64576a6a66b9aca994d69c3af489716e91a9e5ca5956d457c53ce2f772ee15f81b7c8a10b8636243a961f119

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b361ed065c91a698c777c22da6e41e1d916fbcd980e25d81a10cfee59e2547b.exe.exe
Filesize
2.8MB

MD5
095092f4e746810c5829038d48afd55a

SHA1
246eb3d41194dddc826049bbafeb6fc522ec044a

SHA256
2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

SHA512
7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
996b0e5e8db689556a82892efd556832

SHA1
eb4966a0e1594df6581924853886a50c99fed3ec

SHA256
d2ed362e2a8b0801c8556adb5f5421073a18a244b43862cfd2afdc569ee298d9

SHA512
8c7444e5853c53655ed4c42b31a050df1cd52912220e4123bdfd10f9d7e43bdb99a813d2537a56664ef6d0f23bd97e7de148c4f882eedd702f887e65d9cbe841

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini
Filesize
9B

MD5
31874817e0fb055be8d2c971c0e3bbde

SHA1
ee8a35d6a86cb6d13f354d67d912e194bb09c74b

SHA256
94de8b492bc2db9a9592f7c9433547eb7f80826ed67f48d2bb7e22db9d49f544

SHA512
55747c69ae50fa212576d095f60cf33b42e26789cf8c34fc5120a45b1988aae95f91d9e37cb17298c5ac5243b2e4c40e1d0e084ce7fe14bceb4ebb318c65c944

Download Submit
memory/1188-28-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2424-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2424-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2424-16-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/2712-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2712-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2712-3343-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2712-4175-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads