b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36

General

Target

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
Size

47KB
MD5

35ad4a5df82a58e29516cc6cecfa7988
SHA1

8839daf770de6a149ca22983450353f67c3ed009
SHA256

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36
SHA512

f7cc0b34b0682e1f522f6723f5800968782f1c86f91f3c640779438c7609e2f468b51a114dbb9eb864ff68fe350ef73e97addd3fe1dad1b8f08c2cbc98f9f411
SSDEEP

768:QioRJbj/O5RroZJ767395uINCjPZf44S6nCaexaNjWQ3655Kv1X/qY1MSd:QioRJbj/e+Zk77RNCLp44x6UHqaNrFd

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exeb914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

pid process

2408 Logo1_.exe
1548 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2408	Logo1_.exe
1548	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

Logo1_.exeb914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe

description	ioc	process
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
File created	C:\Windows\Logo1_.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exeLogo1_.exe

pid	process
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe
2408	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exenet.execmd.exeLogo1_.exenet.exenet.exe

description	pid	process	target process
PID 648 wrote to memory of 640	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 648 wrote to memory of 640	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 648 wrote to memory of 640	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	net.exe
PID 640 wrote to memory of 4856	640	net.exe	net1.exe
PID 640 wrote to memory of 4856	640	net.exe	net1.exe
PID 640 wrote to memory of 4856	640	net.exe	net1.exe
PID 648 wrote to memory of 1064	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 648 wrote to memory of 1064	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 648 wrote to memory of 1064	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	cmd.exe
PID 648 wrote to memory of 2408	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 648 wrote to memory of 2408	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 648 wrote to memory of 2408	648	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe	Logo1_.exe
PID 1064 wrote to memory of 1548	1064	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 1064 wrote to memory of 1548	1064	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 1064 wrote to memory of 1548	1064	cmd.exe	b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
PID 2408 wrote to memory of 1616	2408	Logo1_.exe	net.exe
PID 2408 wrote to memory of 1616	2408	Logo1_.exe	net.exe
PID 2408 wrote to memory of 1616	2408	Logo1_.exe	net.exe
PID 1616 wrote to memory of 5052	1616	net.exe	net1.exe
PID 1616 wrote to memory of 5052	1616	net.exe	net1.exe
PID 1616 wrote to memory of 5052	1616	net.exe	net1.exe
PID 2408 wrote to memory of 3660	2408	Logo1_.exe	net.exe
PID 2408 wrote to memory of 3660	2408	Logo1_.exe	net.exe
PID 2408 wrote to memory of 3660	2408	Logo1_.exe	net.exe
PID 3660 wrote to memory of 2492	3660	net.exe	net1.exe
PID 3660 wrote to memory of 2492	3660	net.exe	net1.exe
PID 3660 wrote to memory of 2492	3660	net.exe	net1.exe
PID 2408 wrote to memory of 3240	2408	Logo1_.exe	Explorer.EXE
PID 2408 wrote to memory of 3240	2408	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3240

C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:4856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"
4⤵
- Executes dropped EXE
PID:1548

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:5052

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
258KB

MD5
087437b5d40197b39196f13de881a4c3

SHA1
1730cf453aae759eb6270bd4268270f99648019c

SHA256
64300550756f2872e5cc83e44b3a9e9a1fd48db40d70255244d7fea2d7188256

SHA512
9cf8e79721002615fd73b80ad843b5a36db0fab4adac9a9411800b0e506b25b61fdaf939ea2bb60291694abc50449afb4106e3af327971b89d926624c9d00ae0

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
577KB

MD5
b18288af60b5a5145bcc8c16d5f876e0

SHA1
5997adbc3d70e593914f7084ce020739e8eb390c

SHA256
3d62454a3b6609ca8420823c9443f2cafb90aa55ad139681d86b7b124beaca3f

SHA512
83dd4b6c63bfc7bca51e9e7b58411c3b6cf8419db0356fbd1254f27fb6434e995f6a8fd9acf47a67a50d073d0a865c31adc42cdd4ee1589b5dd5913e8ffc555f

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Filesize
488KB

MD5
85b76d0e0da4b34c0acc7abcd83d7150

SHA1
3c361c827353e87281950c2baef4ed7a24eee844

SHA256
a2beda607517ea941d193ff76cd746ba01dd55a62725874c59e93776cf3f3f53

SHA512
407a41a1fd8a4e24dbddbc624a50a94d101c541e9d73e5db4b1fa68fd2915c1cb92f6444fa8416429134b88610de31be620eaacda2b9a96e76182ca2323c3644

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aD6.bat
Filesize
720B

MD5
c0d2ff75186424903714c7f2e203aa48

SHA1
0234f493b6fec57ef8e9070f60a5fdb1be023195

SHA256
f002213517afbe609dad87b9644b4fd4e7d0e56f126898fd62805cf45820a5db

SHA512
4038f96901973d7a6e26216907ccca12593aaa1ed6a20996b25d564c41beda36d51c7acc42fe0e69323d239c03d7939805b27a0ad344e40c171f4a2783f9c9bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe.exe
Filesize
14KB

MD5
ad782ffac62e14e2269bf1379bccbaae

SHA1
9539773b550e902a35764574a2be2d05bc0d8afc

SHA256
1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

SHA512
a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
a51381d9a97c98438725ecee862236b3

SHA1
fab4fca7633bc7de56ad02bc5a8165e709e9f06b

SHA256
84aa7b7f5581336f4b54c55b70d17c1fb0460db983f55739d01d158eedee8668

SHA512
c70207ff04c9a65c2f06400b65ca7597d075743af5c62e02b625e4ed30289075fe314872bbbb6037833e1eb6d5b07c506392637e3122ef642e6afb544a0ee82e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini
Filesize
9B

MD5
31874817e0fb055be8d2c971c0e3bbde

SHA1
ee8a35d6a86cb6d13f354d67d912e194bb09c74b

SHA256
94de8b492bc2db9a9592f7c9433547eb7f80826ed67f48d2bb7e22db9d49f544

SHA512
55747c69ae50fa212576d095f60cf33b42e26789cf8c34fc5120a45b1988aae95f91d9e37cb17298c5ac5243b2e4c40e1d0e084ce7fe14bceb4ebb318c65c944

Download Submit
memory/648-11-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/648-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-323-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-1723-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-2468-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-9-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-5434-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-7543-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2408-8817-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads