64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f

General

Target

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
Size

264KB
MD5

ad9b009d9569c9bf6baeb4b690f42adf
SHA1

124ee22361eb16367a8e2f3ff385a7957410b335
SHA256

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f
SHA512

cf86b80db82bbd115610bf3dff67e5154f4091b34c318dfcec89911bb9154dee9d7c82993d2fb4902e2a7ca0e1ff4fe1e5266905b84d38c0081e7a2b43bdbfc5
SSDEEP

6144:l/KW+aezigiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:wW+aYitXqsTkiR7twRx+gD8PJ

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2940 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe

pid process

2556 Logo1_.exe
2456 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2940 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2940	cmd.exe

pid	process
2556	Logo1_.exe
2456	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe

pid	process
2940	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Install\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

Logo1_.exe64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe

description	ioc	process
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
File created	C:\Windows\Logo1_.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exeLogo1_.exe

pid	process
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exenet.exeLogo1_.execmd.exenet.exenet.exe

description	pid	process	target process
PID 2740 wrote to memory of 1756	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 2740 wrote to memory of 1756	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 2740 wrote to memory of 1756	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 2740 wrote to memory of 1756	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 1756 wrote to memory of 2192	1756	net.exe	net1.exe
PID 1756 wrote to memory of 2192	1756	net.exe	net1.exe
PID 1756 wrote to memory of 2192	1756	net.exe	net1.exe
PID 1756 wrote to memory of 2192	1756	net.exe	net1.exe
PID 2740 wrote to memory of 2940	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 2740 wrote to memory of 2940	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 2740 wrote to memory of 2940	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 2740 wrote to memory of 2940	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 2740 wrote to memory of 2556	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 2740 wrote to memory of 2556	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 2740 wrote to memory of 2556	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 2740 wrote to memory of 2556	2740	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 2556 wrote to memory of 2604	2556	Logo1_.exe	net.exe
PID 2556 wrote to memory of 2604	2556	Logo1_.exe	net.exe
PID 2556 wrote to memory of 2604	2556	Logo1_.exe	net.exe
PID 2556 wrote to memory of 2604	2556	Logo1_.exe	net.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2940 wrote to memory of 2456	2940	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 2604 wrote to memory of 2568	2604	net.exe	net1.exe
PID 2604 wrote to memory of 2568	2604	net.exe	net1.exe
PID 2604 wrote to memory of 2568	2604	net.exe	net1.exe
PID 2604 wrote to memory of 2568	2604	net.exe	net1.exe
PID 2556 wrote to memory of 2724	2556	Logo1_.exe	net.exe
PID 2556 wrote to memory of 2724	2556	Logo1_.exe	net.exe
PID 2556 wrote to memory of 2724	2556	Logo1_.exe	net.exe
PID 2556 wrote to memory of 2724	2556	Logo1_.exe	net.exe
PID 2724 wrote to memory of 2496	2724	net.exe	net1.exe
PID 2724 wrote to memory of 2496	2724	net.exe	net1.exe
PID 2724 wrote to memory of 2496	2724	net.exe	net1.exe
PID 2724 wrote to memory of 2496	2724	net.exe	net1.exe
PID 2556 wrote to memory of 1208	2556	Logo1_.exe	Explorer.EXE
PID 2556 wrote to memory of 1208	2556	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
"C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:2192

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940

C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
"C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"
4⤵
- Executes dropped EXE
PID:2456

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2568

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2496

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Filesize
484KB

MD5
edc9d968c214a944e019fad26d1a18a5

SHA1
28dacfbfe9840c27f5af05343af82338786b1f36

SHA256
b0f8dc8ea8e999b6c25e460e2f644f2ed41b2e481f57f5800de9c0c93c9ef275

SHA512
f381ea38921a0163ced1feb11a9748010b2bf76f8eaf66ae326e98eb5d5ff75bc4b4342b4d3acf27a5177393c5b05cf43bb007ceb1d7799498e8429c8efb86a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
Filesize
722B

MD5
88ece3e4bf8c971b117f691e89ab2266

SHA1
c0be26c5ab4f39f88ded906945f7d5683afa6283

SHA256
4ad2e394d78338b1ea74fb0ddc15e770a1dae64628b78d10c3b201997b24bb95

SHA512
bbfce54985b8bbb6d8ccc5ebc1ec4d3e76fd05996013afdf349dde5203207414c514c41a90ba2fd21bd1b5fbd3315a91b4fba861dd48f1f7e96e3c2fbff8dd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe.exe
Filesize
224KB

MD5
d4b257c01bbaa68d15d8368475a4e227

SHA1
fafae083a882e163cfa8c77258baaab891c17df2

SHA256
dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546

SHA512
167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502

Download Submit
C:\Windows\Logo1_.exe
Filesize
39KB

MD5
253b6789d1d5e4699bfc49109ab67490

SHA1
14f55722f832b7a172d3dfd47d6688607b3d5fcd

SHA256
36452d9a6405a90cf6c493850f489326b6e9b36ab223bac70ebd7c6202e7f4d6

SHA512
b21643bf9817af9255865ed5534b155ef9a6686bc5b2c3a0de2a29d270c9bb3d58d5fb411053e76cdf6367eb8fee3c0a6543da926b3d7431ec51c752d03c6985

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.ini
Filesize
9B

MD5
304501c003da3bc5756aa53a757c30cc

SHA1
94dfcea0ef17f89b3a60a85a07edb4c00170cc1c

SHA256
9f4b03cbd52378f329bfc7088f8242bbc1a0a2754bc2f8a40e3b74e0dedecd6e

SHA512
78cd3c2cb4cb66e41d8947e1231256c2043d71c77f97e92915e938a6c1d9a8c003512027d98bc71bf582875d269e5fbe6e134f57b25f5f79fe16f9a412387dc8

Download Submit
memory/1208-27-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/2556-18-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-30-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-3318-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-4143-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2740-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2740-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads