deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8

General

Target

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
Size

1.6MB
MD5

15fdfb61c3bcf26af3548d7fade4a8ae
SHA1

d76af19cc583ea66d0caa943a9593761c19dd020
SHA256

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8
SHA512

ef7c675344345e9a9d354c583d29b589571a2b892fe03f2d620f04fe955a82d838a611aef44fed844ad66be916c95b784b754f3eeec693a7ffaaa02e8095d956
SSDEEP

24576:77Fy4FMmZg15PgU+/uka4YjCp/SKhdm87PUY9Zbvhjdqdb3rWBvO0yjm0cg78:7737Rp/7dmGN9tJjdqRrwvol78

Score

7^/10

bootkit persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2284 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exedeca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

pid process

2832 Logo1_.exe
2616 deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2284 cmd.exe

pid	process
2284	cmd.exe

pid	process
2284	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

description ioc process

File opened for modification \??\PhysicalDrive0 deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
File created	C:\Windows\Logo1_.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Logo1_.exe

pid	process
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exeLogo1_.execmd.exenet.exe

description	pid	process	target process
PID 2244 wrote to memory of 2284	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2244 wrote to memory of 2284	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2244 wrote to memory of 2284	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2244 wrote to memory of 2284	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2244 wrote to memory of 2832	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 2244 wrote to memory of 2832	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 2244 wrote to memory of 2832	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 2244 wrote to memory of 2832	2244	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 2832 wrote to memory of 2724	2832	Logo1_.exe	net.exe
PID 2832 wrote to memory of 2724	2832	Logo1_.exe	net.exe
PID 2832 wrote to memory of 2724	2832	Logo1_.exe	net.exe
PID 2832 wrote to memory of 2724	2832	Logo1_.exe	net.exe
PID 2284 wrote to memory of 2616	2284	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 2284 wrote to memory of 2616	2284	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 2284 wrote to memory of 2616	2284	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 2284 wrote to memory of 2616	2284	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 2724 wrote to memory of 2820	2724	net.exe	net1.exe
PID 2724 wrote to memory of 2820	2724	net.exe	net1.exe
PID 2724 wrote to memory of 2820	2724	net.exe	net1.exe
PID 2724 wrote to memory of 2820	2724	net.exe	net1.exe
PID 2832 wrote to memory of 1208	2832	Logo1_.exe	Explorer.EXE
PID 2832 wrote to memory of 1208	2832	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
"C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe"
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a23D6.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
"C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe"
4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2616

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2820

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
251KB

MD5
3d1572bb8bd0f47c8bae09ad1cd6d327

SHA1
1200b1b3f2404dcef74dfcf8affde5b605bc9114

SHA256
60aa8a96919888258a3b10447d91f4f83993e7fefbf9c7e32b21124c1cdfd262

SHA512
d7b7b18682e5f58e72b9d3a27c2d334c3db00e44a6b1faf1a765390356e8b20e69e4189e95487e56c3aca2710d761fecc069d764e73b64ea4ae6229f3460f9b0

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a23D6.bat
Filesize
722B

MD5
75f71f4f73e37097d423fda9a2897883

SHA1
e64de635d3285df3e7a7deadd25d7c59ab92b42f

SHA256
37aea7b05dd7c89df1858c507776938601c157479463262194a0ed7978cf584e

SHA512
8e2dd3b467a0b87fd7bc02b6a66423a430569055a84fba10ccb9d63f19ae0740dbd9d1854fb14d5652be72232c5bfc268600c6cf5edaf424b82738031e228adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe.exe
Filesize
1.6MB

MD5
fd3162b9c1bd31c14851d3baf1055a90

SHA1
efe65a5df571257e15186ea339769cb61a98e2c3

SHA256
7fae64292d2c11b04a990140ab7b12f5a37eb74998c16a174ec13339783893b8

SHA512
d64efd63595fff017e3e90d1eb1203c28a4131444a71d7111efb2ec7761578f498da31409f5aa57a47c118c6727fab18371e4687d651b26847e543c478b83636

Download Submit
C:\Windows\Logo1_.exe
Filesize
26KB

MD5
0a9fcb5422705ccc52b97a0f291ad9bc

SHA1
1464f8724a42524e5dc47483eb6288e9c34fec22

SHA256
85272876bcd6492a6bb54bfc95d2c4dc6d8cbee27dc11f7a60cad6620954a933

SHA512
f719785fecf4087ebd2ca0ff8ade00136472ab2b41dedcf3a9ecbb902f669c7449b395d0c92a9c2e6514dc48447c9eafaa54baf667f0050c42d212a08e632c3b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\_desktop.ini
Filesize
9B

MD5
a470ca2426c102d035971b2e504d921b

SHA1
1720ef61e5c8e2ad6da9992a78940228fc81d615

SHA256
13721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5

SHA512
c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831

Download Submit
memory/1208-29-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/2244-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2244-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-1874-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-2016-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-3334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

pid	process
2832	Logo1_.exe
2616	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads