Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 14:54

General

  • Target

    5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff.exe

  • Size

    5.7MB

  • MD5

    9801aeac198b42944dff1f476de6e746

  • SHA1

    378e7e7918e4deaf286a550120d31fb8e44dfa92

  • SHA256

    5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff

  • SHA512

    12ce5b322088f7ec63f5ff8798db0840dcaf7b7e0b5e3f32ac7385fae44d17f594d45f6bf33866ee4aa00a3374f412242cc6e16de9939da2d2f7ff2490fc7370

  • SSDEEP

    49152:iPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:0KUgTH2M2m9UMpu1QfLczqssnKSk

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1152
      • C:\Users\Admin\AppData\Local\Temp\5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff.exe
        "C:\Users\Admin\AppData\Local\Temp\5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3020
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2780
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1861.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            PID:2336
            • C:\Users\Admin\AppData\Local\Temp\5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff.exe
              "C:\Users\Admin\AppData\Local\Temp\5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff.exe"
              4⤵
              • Executes dropped EXE
              PID:2824
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2604
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2488
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2764
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2396

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                  Filesize

                  258KB

                  MD5

                  25161eb204d86328bf9af51c9f0753b9

                  SHA1

                  b68529e2a928f8c5c424474eb69ceae0415d9c0c

                  SHA256

                  c600e7f71b7a59ba015142cb4411f8fd86e6888ed41e55298c21289c3a8ac315

                  SHA512

                  e7d13a41338fe1787b44feddd74dcccd200ce2f069766cabeb76b7cbe957ef22a41499a11229c94e06fd59462a6b824fa62d7d13cc362c7adf2f1e05c03de926

                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

                  Filesize

                  478KB

                  MD5

                  5700ba4e3909c1880d8210357d85dc81

                  SHA1

                  f24e2100cc3cee398eb116957faa839e69e73d0a

                  SHA256

                  853f0d42da7e7db96eda3ffc261acbf0ae35585311d8919f8cd87c2984c1e1bd

                  SHA512

                  e54dd8ba25b56287ef4c4f6d427df62f5dca49c5bf6095146c86cbfc35238506aa1015d0e470663392f5470e2cd7eed838e60c105183dbe51a496f75098e8c8c

                • C:\Users\Admin\AppData\Local\Temp\$$a1861.bat

                  Filesize

                  722B

                  MD5

                  e8d0a495a5c28f734de357b1551c6834

                  SHA1

                  0ad8fbd3d4f56cb6bc05fb5ac3893d748781089b

                  SHA256

                  748ea4a583b88e45d7fd2bcda133a07184b46e7f31bb86223a4788d45806a000

                  SHA512

                  9bff037271165f183a7a69a3a08b62ff8e88fae7b03ba76095b805b836b30f6d69ad3475e13e10ed6df726e51174a03f975ecb40dbe62e0c25f2ec283ea7509d

                • C:\Users\Admin\AppData\Local\Temp\5591a9fa585535638d04783fe1d33206a3c5f2f01fe5008315e5f92096054dff.exe.exe

                  Filesize

                  5.7MB

                  MD5

                  ba18e99b3e17adb5b029eaebc457dd89

                  SHA1

                  ec0458f3c00d35b323f08d4e1cc2e72899429c38

                  SHA256

                  f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

                  SHA512

                  1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

                • C:\Windows\Logo1_.exe

                  Filesize

                  33KB

                  MD5

                  5a63f8e9068767deb1ccd980deb047fa

                  SHA1

                  9383b1103782394fbbee5705456e4f3600a86b66

                  SHA256

                  29de80ac5ca4f60d8fbdc59d956164370d31dd5d4504cf8fa97c29800eb7766c

                  SHA512

                  f42e3e5217dd13e7efa8092969e65f1b5eb1273d12685c90c5b3ca31e2a9502e12244111d555245e4f8505c0cdadfb7e73c565e2dcbd8fab568867957652b5bc

                • F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini

                  Filesize

                  9B

                  MD5

                  fa1e1ef0fdda97877a13339b28fa95e5

                  SHA1

                  7e2cffca41118e7b2d62963bd940630b15b85653

                  SHA256

                  968b715c081472526487d60da8968e9b3bde2dac103f69beb3f6abe6ef7bc191

                  SHA512

                  3d55913a97aa89a7201342705640c1d031d19ad8aca4939219067f84e3fe118f47b4e388f490f69f605683d3854425c3de188f731886405474ae8e3d42c86f4f

                • memory/1152-27-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

                  Filesize

                  4KB

                • memory/2612-31-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2612-19-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2612-3302-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2612-4133-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/3020-0-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/3020-17-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB