64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f

General

Target

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
Size

264KB
MD5

ad9b009d9569c9bf6baeb4b690f42adf
SHA1

124ee22361eb16367a8e2f3ff385a7957410b335
SHA256

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f
SHA512

cf86b80db82bbd115610bf3dff67e5154f4091b34c318dfcec89911bb9154dee9d7c82993d2fb4902e2a7ca0e1ff4fe1e5266905b84d38c0081e7a2b43bdbfc5
SSDEEP

6144:l/KW+aezigiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:wW+aYitXqsTkiR7twRx+gD8PJ

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe

pid process

4416 Logo1_.exe
1904 64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4416	Logo1_.exe
1904	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
File created	C:\Windows\Logo1_.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exeLogo1_.exe

pid	process
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe
4416	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exenet.exeLogo1_.execmd.exenet.exenet.exe

description	pid	process	target process
PID 4648 wrote to memory of 3488	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 4648 wrote to memory of 3488	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 4648 wrote to memory of 3488	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	net.exe
PID 3488 wrote to memory of 1168	3488	net.exe	net1.exe
PID 3488 wrote to memory of 1168	3488	net.exe	net1.exe
PID 3488 wrote to memory of 1168	3488	net.exe	net1.exe
PID 4648 wrote to memory of 1720	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 4648 wrote to memory of 1720	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 4648 wrote to memory of 1720	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	cmd.exe
PID 4648 wrote to memory of 4416	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 4648 wrote to memory of 4416	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 4648 wrote to memory of 4416	4648	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe	Logo1_.exe
PID 4416 wrote to memory of 4568	4416	Logo1_.exe	net.exe
PID 4416 wrote to memory of 4568	4416	Logo1_.exe	net.exe
PID 4416 wrote to memory of 4568	4416	Logo1_.exe	net.exe
PID 1720 wrote to memory of 1904	1720	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 1720 wrote to memory of 1904	1720	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 1720 wrote to memory of 1904	1720	cmd.exe	64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
PID 4568 wrote to memory of 3472	4568	net.exe	net1.exe
PID 4568 wrote to memory of 3472	4568	net.exe	net1.exe
PID 4568 wrote to memory of 3472	4568	net.exe	net1.exe
PID 4416 wrote to memory of 396	4416	Logo1_.exe	net.exe
PID 4416 wrote to memory of 396	4416	Logo1_.exe	net.exe
PID 4416 wrote to memory of 396	4416	Logo1_.exe	net.exe
PID 396 wrote to memory of 2024	396	net.exe	net1.exe
PID 396 wrote to memory of 2024	396	net.exe	net1.exe
PID 396 wrote to memory of 2024	396	net.exe	net1.exe
PID 4416 wrote to memory of 3444	4416	Logo1_.exe	Explorer.EXE
PID 4416 wrote to memory of 3444	4416	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444

C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
"C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50DF.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe
"C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe"
4⤵
- Executes dropped EXE
PID:1904

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:3472

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe
Filesize
583KB

MD5
c242260e04c259e5b86393e7fc483c58

SHA1
362241689204b12908af66e9a1cb34249efc19cb

SHA256
4b3d340a135393c503d5ec532c93ebf36602899e81dddacda4ec382cc9b5a68c

SHA512
16da1a4cf681c2dc8d4cc311137fa8c45fbd086b116c5bcb066a73ba89cbdc1c0e53bfe69eb2a2d214b1499268b2bdbf22791652f7567249ff435ffb8c6e4d48

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize
649KB

MD5
006e8207aa163306a5174b6dea4b573f

SHA1
412a2165e9732fcae518386013c7d0d124c58780

SHA256
97b5e11d59b882a2bec3e62394e53ce8d2aa96f24ba4f991d43422ba452afeef

SHA512
5234a1fc74155bc5a0e02728e691003d51cd9b23b75f196964883600cf148776f3833d3237bc00d7f27cf0b7f15f3bcc3dbe37a00883eeb9c3cd0c93bdb3a2cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a50DF.bat
Filesize
722B

MD5
2af6f5a698bba25624535c6478321c31

SHA1
6b0f24b2cb21cdbd5aa9d90d5ffd94e1c664a307

SHA256
1dbdb6bc27ffe42a51afbb5c815895bbe035977231060f497815a082406a2694

SHA512
4d243e5f84490a2d7b9f0058711ad21973653d62c0871d87a9f566d5029095e5587a83f78a27a43e605aae9f1847fddd7da4b4403f4650c29797a2489f83c6e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\64bd46a7b16cd880e4989fb87c28fa120f108f724ad1546027ff06c605238e9f.exe.exe
Filesize
224KB

MD5
d4b257c01bbaa68d15d8368475a4e227

SHA1
fafae083a882e163cfa8c77258baaab891c17df2

SHA256
dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546

SHA512
167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502

Download Submit
C:\Windows\Logo1_.exe
Filesize
39KB

MD5
253b6789d1d5e4699bfc49109ab67490

SHA1
14f55722f832b7a172d3dfd47d6688607b3d5fcd

SHA256
36452d9a6405a90cf6c493850f489326b6e9b36ab223bac70ebd7c6202e7f4d6

SHA512
b21643bf9817af9255865ed5534b155ef9a6686bc5b2c3a0de2a29d270c9bb3d58d5fb411053e76cdf6367eb8fee3c0a6543da926b3d7431ec51c752d03c6985

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\_desktop.ini
Filesize
9B

MD5
304501c003da3bc5756aa53a757c30cc

SHA1
94dfcea0ef17f89b3a60a85a07edb4c00170cc1c

SHA256
9f4b03cbd52378f329bfc7088f8242bbc1a0a2754bc2f8a40e3b74e0dedecd6e

SHA512
78cd3c2cb4cb66e41d8947e1231256c2043d71c77f97e92915e938a6c1d9a8c003512027d98bc71bf582875d269e5fbe6e134f57b25f5f79fe16f9a412387dc8

Download Submit
memory/4416-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4416-18-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4416-5210-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4416-8669-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4648-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4648-9-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads