b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36

General

Target

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
Size

47KB
MD5

35ad4a5df82a58e29516cc6cecfa7988
SHA1

8839daf770de6a149ca22983450353f67c3ed009
SHA256

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36
SHA512

f7cc0b34b0682e1f522f6723f5800968782f1c86f91f3c640779438c7609e2f468b51a114dbb9eb864ff68fe350ef73e97addd3fe1dad1b8f08c2cbc98f9f411
SSDEEP

768:QioRJbj/O5RroZJ767395uINCjPZf44S6nCaexaNjWQ3655Kv1X/qY1MSd:QioRJbj/e+Zk77RNCLp44x6UHqaNrFd

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2648 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exeb914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

pid process

2808 Logo1_.exe
2712 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2648 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2648	cmd.exe

pid	process
2808	Logo1_.exe
2712	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

pid	process
2648	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Internet Explorer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Journal\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
File created	C:\Windows\Logo1_.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exeLogo1_.exe

pid	process
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe
2808	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

pid process

2712 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

pid	process
2712	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 3016 wrote to memory of 2488	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 3016 wrote to memory of 2488	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 3016 wrote to memory of 2488	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 3016 wrote to memory of 2488	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 2488 wrote to memory of 1524	2488	net.exe	net1.exe
PID 2488 wrote to memory of 1524	2488	net.exe	net1.exe
PID 2488 wrote to memory of 1524	2488	net.exe	net1.exe
PID 2488 wrote to memory of 1524	2488	net.exe	net1.exe
PID 3016 wrote to memory of 2648	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 3016 wrote to memory of 2648	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 3016 wrote to memory of 2648	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 3016 wrote to memory of 2648	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 3016 wrote to memory of 2808	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 3016 wrote to memory of 2808	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 3016 wrote to memory of 2808	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 3016 wrote to memory of 2808	3016	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 2808 wrote to memory of 2784	2808	Logo1_.exe	net.exe
PID 2808 wrote to memory of 2784	2808	Logo1_.exe	net.exe
PID 2808 wrote to memory of 2784	2808	Logo1_.exe	net.exe
PID 2808 wrote to memory of 2784	2808	Logo1_.exe	net.exe
PID 2784 wrote to memory of 2832	2784	net.exe	net1.exe
PID 2784 wrote to memory of 2832	2784	net.exe	net1.exe
PID 2784 wrote to memory of 2832	2784	net.exe	net1.exe
PID 2784 wrote to memory of 2832	2784	net.exe	net1.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2648 wrote to memory of 2712	2648	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2808 wrote to memory of 2716	2808	Logo1_.exe	net.exe
PID 2808 wrote to memory of 2716	2808	Logo1_.exe	net.exe
PID 2808 wrote to memory of 2716	2808	Logo1_.exe	net.exe
PID 2808 wrote to memory of 2716	2808	Logo1_.exe	net.exe
PID 2716 wrote to memory of 2768	2716	net.exe	net1.exe
PID 2716 wrote to memory of 2768	2716	net.exe	net1.exe
PID 2716 wrote to memory of 2768	2716	net.exe	net1.exe
PID 2716 wrote to memory of 2768	2716	net.exe	net1.exe
PID 2808 wrote to memory of 1208	2808	Logo1_.exe	Explorer.EXE
PID 2808 wrote to memory of 1208	2808	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2D09.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648

C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2712

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2832

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2768

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
258KB

MD5
087437b5d40197b39196f13de881a4c3

SHA1
1730cf453aae759eb6270bd4268270f99648019c

SHA256
64300550756f2872e5cc83e44b3a9e9a1fd48db40d70255244d7fea2d7188256

SHA512
9cf8e79721002615fd73b80ad843b5a36db0fab4adac9a9411800b0e506b25b61fdaf939ea2bb60291694abc50449afb4106e3af327971b89d926624c9d00ae0

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Filesize
478KB

MD5
f01e1e0718ca3110b117e544489e3839

SHA1
6c19ce81349add991c3a88926d586b3de6ff9548

SHA256
b044da00ae636042dc22870432b28488014098b7e01350031e82a361d45b588d

SHA512
ee9a34b33e30eed3ef7676c7c86c88f748886527fe61d2133a8f3365d11848de66b1c118ea4d3a05f97363d6dc829c4490e839e20a16847a651cc915b47b5a93

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a2D09.bat
Filesize
722B

MD5
3e3baadd1c4bbb7e012eb06e1ec659a8

SHA1
132347ca27016749c52913396d45ada243b0ae77

SHA256
b3d08e3491faf17054aa3bfa6c6dd37ef5fef90c1983c895833c0b442d11363b

SHA512
eae532b30e2a3e4fa70cfe6c4e9bfded6b20f8a1d7893510f66c366b635071982717ddc608a8fb0d6eb3fae4f17de8d9d4cfd944650dc0d0b283e255d72a5766

Download Submit
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe.exe
Filesize
14KB

MD5
ad782ffac62e14e2269bf1379bccbaae

SHA1
9539773b550e902a35764574a2be2d05bc0d8afc

SHA256
1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

SHA512
a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
a51381d9a97c98438725ecee862236b3

SHA1
fab4fca7633bc7de56ad02bc5a8165e709e9f06b

SHA256
84aa7b7f5581336f4b54c55b70d17c1fb0460db983f55739d01d158eedee8668

SHA512
c70207ff04c9a65c2f06400b65ca7597d075743af5c62e02b625e4ed30289075fe314872bbbb6037833e1eb6d5b07c506392637e3122ef642e6afb544a0ee82e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\_desktop.ini
Filesize
9B

MD5
31874817e0fb055be8d2c971c0e3bbde

SHA1
ee8a35d6a86cb6d13f354d67d912e194bb09c74b

SHA256
94de8b492bc2db9a9592f7c9433547eb7f80826ed67f48d2bb7e22db9d49f544

SHA512
55747c69ae50fa212576d095f60cf33b42e26789cf8c34fc5120a45b1988aae95f91d9e37cb17298c5ac5243b2e4c40e1d0e084ce7fe14bceb4ebb318c65c944

Download Submit
memory/1208-28-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/2808-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2808-20-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2808-3346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2808-4171-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3016-17-0x0000000000880000-0x00000000008BF000-memory.dmp

Filesize
252KB

Download
memory/3016-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3016-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads