Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 14:55

General

  • Target

    59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe

  • Size

    9.1MB

  • MD5

    72e96da3c1660ba9e96e533e94bff3a1

  • SHA1

    baf5a4553c4b31a750d14558faee20970bca5acf

  • SHA256

    59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e

  • SHA512

    1ad449ff7d603ebf2c74c65d14ed8c5e64f4da13901e0e314bd1b50e3281fb316fe487a6f502663e5c7fe443646e4a292db600481534514a01cafd0513d222e4

  • SSDEEP

    98304:SpE4kgB6lqEoBaF0yJERySnnxdiJU5GkGJoY:Sp1b2yyJERySnriJUtGJoY

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe
        "C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2164
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2120
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2536
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2923.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2500
            • C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe
              "C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe"
              4⤵
              • Executes dropped EXE
              PID:2628
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2660
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2860
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1868
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2424

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                  Filesize

                  258KB

                  MD5

                  b0f0ba2ced2322f9b443c020b49aba8e

                  SHA1

                  91b3403975535602f6efea9706c4cc8d8b4c10b5

                  SHA256

                  708c46a3f135edb785d489050463c9e5acb5f96c089577eb2f806438b4da6a12

                  SHA512

                  9e96244b2f2a4370055ad8bc6600452921bc6cb7766457fc8d700938ca620d2e6722aa2bab8f97ff562a9bc4f54ff70a6de05614a7e781742be78ab32586952f

                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

                  Filesize

                  478KB

                  MD5

                  a64e221e7aa252d2cafadf779e374ad0

                  SHA1

                  5043394894c490e1964e52918ac6648359046dbc

                  SHA256

                  a183bc22f75dc7df2202c1d3100d4e20ca73028a03dff5b81a5864de0fedcad0

                  SHA512

                  ed60c60a6897a7744ae96ac4a783b18ab8925edcd66e4155dc48b8f56f252f521649d59f35b1680856e30e0aed3d0dad62acd39148cccf7779706467b57f0283

                • C:\Users\Admin\AppData\Local\Temp\$$a2923.bat

                  Filesize

                  722B

                  MD5

                  e9f9541799ad76146d2c71bae7892fba

                  SHA1

                  6b8bd8b7683577dc5210e970f4e02d063723b2c1

                  SHA256

                  55b200a8b738eac7693f9527870151a3fe56b57d34799cd046dfe5c12b8dfa7a

                  SHA512

                  1025f7ef084faa68b16b519cc9a4002da4500bf4b59281ab30dc5a0bae65df865d6ba331b171e61b23d4b1288ac8edf82e4ad9115aef8613894a4d05e12e6ae6

                • C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe.exe

                  Filesize

                  9.0MB

                  MD5

                  4f4608dd4d3246360a9c53b14d4e3ad7

                  SHA1

                  8774ebd330496951e156d3fd08170f1e14c76401

                  SHA256

                  0e886c735baf30f4a7c9f91751fc631624c0ded01b76d9570aa26f2289a28c8e

                  SHA512

                  07c635e9469934274481d7158f422e3d3483ab06e50658697edd0f133dfbf5096c04605fe3ce50a8215a0c6ace3c6b5123bd6b76b36d004b1ef3b9cc26b1225c

                • C:\Windows\Logo1_.exe

                  Filesize

                  33KB

                  MD5

                  a0b93ff728f6114ae0074a2b4a5bcd47

                  SHA1

                  e795935cb0e0cb344e27bda4899f238a77af6258

                  SHA256

                  45d9f916a1fa961daa8391edf289e7a0d76f055af591c873f7b9215b9c2224cb

                  SHA512

                  0ef7dc4a992dae6fe8b59addbafebdf1cc1d2fdf13b33a4e09d0740718bb61d2a8ccfd19eb505e00f119bfe266fac800a0dc541d2d5eefe29ea68cc693619160

                • F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\_desktop.ini

                  Filesize

                  9B

                  MD5

                  fa1e1ef0fdda97877a13339b28fa95e5

                  SHA1

                  7e2cffca41118e7b2d62963bd940630b15b85653

                  SHA256

                  968b715c081472526487d60da8968e9b3bde2dac103f69beb3f6abe6ef7bc191

                  SHA512

                  3d55913a97aa89a7201342705640c1d031d19ad8aca4939219067f84e3fe118f47b4e388f490f69f605683d3854425c3de188f731886405474ae8e3d42c86f4f

                • memory/1192-28-0x0000000002D80000-0x0000000002D81000-memory.dmp

                  Filesize

                  4KB

                • memory/2164-0-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2164-17-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2528-31-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2528-19-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2528-3282-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2528-4093-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB