Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 14:55

General

  • Target

    59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe

  • Size

    9.1MB

  • MD5

    72e96da3c1660ba9e96e533e94bff3a1

  • SHA1

    baf5a4553c4b31a750d14558faee20970bca5acf

  • SHA256

    59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e

  • SHA512

    1ad449ff7d603ebf2c74c65d14ed8c5e64f4da13901e0e314bd1b50e3281fb316fe487a6f502663e5c7fe443646e4a292db600481534514a01cafd0513d222e4

  • SSDEEP

    98304:SpE4kgB6lqEoBaF0yJERySnnxdiJU5GkGJoY:Sp1b2yyJERySnriJUtGJoY

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3580
      • C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe
        "C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5092
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:4956
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF2.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2520
            • C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe
              "C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe"
              4⤵
              • Executes dropped EXE
              PID:3772
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2252
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3864
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:576
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4192
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:3304

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                  Filesize

                  258KB

                  MD5

                  b0f0ba2ced2322f9b443c020b49aba8e

                  SHA1

                  91b3403975535602f6efea9706c4cc8d8b4c10b5

                  SHA256

                  708c46a3f135edb785d489050463c9e5acb5f96c089577eb2f806438b4da6a12

                  SHA512

                  9e96244b2f2a4370055ad8bc6600452921bc6cb7766457fc8d700938ca620d2e6722aa2bab8f97ff562a9bc4f54ff70a6de05614a7e781742be78ab32586952f

                • C:\Program Files\BlockGroup.exe

                  Filesize

                  833KB

                  MD5

                  10ad5bd47db9536ccda61725397bff84

                  SHA1

                  83c3753fb524d380558c137706eb9dcb2ef12f97

                  SHA256

                  5c1a41021234b87def340f5ba83ec3b12d6163238c1731b15e7b16a7f11a636d

                  SHA512

                  358f8dbbcfbed2fae4bfc91d38c98e51a483a5f0eeb75c4808f3e3530da377ca147d903f5c5a1351ae3f32da483042078f129d90adfe882934340d5a1d6d4917

                • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

                  Filesize

                  643KB

                  MD5

                  7ffaf51fff2639d8923d04179f9314bb

                  SHA1

                  0b0294941f7748cb7d9762cb5bb6bfab00f6547c

                  SHA256

                  b0595af7730af742eb37282aa3146d5c399279c2305b8e9c81ffcbb825824913

                  SHA512

                  02b5bcb3e254084c755e7211f7abc4387b9b5eb4ea900c5cbaee69e749cfc95c074cf8389e7e18e2895d8ed145e50e042d00c2cc0433d0275f383101a2930572

                • C:\Users\Admin\AppData\Local\Temp\$$a8EF2.bat

                  Filesize

                  722B

                  MD5

                  42fe68e779aa5cddaec174196402edbe

                  SHA1

                  9c40af5f9934ab0bfcfe61218af1601581f5a55a

                  SHA256

                  7436dff0a7249de5b051b2f251c3342b89edbd0a8b1847ec19bee85e4c97f063

                  SHA512

                  f777ae38a652c956b27f2d2bf0c205fbb2a7076d6130a828c58c087c6a8e79316eba6c630839567102e84099090d00e04fdd301b9a9551c397e80d0a3ead1ce6

                • C:\Users\Admin\AppData\Local\Temp\59e62592a1b00c92c45bcfb318d6b7cf0e2efb5840474944410a62954d78283e.exe.exe

                  Filesize

                  9.0MB

                  MD5

                  4f4608dd4d3246360a9c53b14d4e3ad7

                  SHA1

                  8774ebd330496951e156d3fd08170f1e14c76401

                  SHA256

                  0e886c735baf30f4a7c9f91751fc631624c0ded01b76d9570aa26f2289a28c8e

                  SHA512

                  07c635e9469934274481d7158f422e3d3483ab06e50658697edd0f133dfbf5096c04605fe3ce50a8215a0c6ace3c6b5123bd6b76b36d004b1ef3b9cc26b1225c

                • C:\Windows\Logo1_.exe

                  Filesize

                  33KB

                  MD5

                  a0b93ff728f6114ae0074a2b4a5bcd47

                  SHA1

                  e795935cb0e0cb344e27bda4899f238a77af6258

                  SHA256

                  45d9f916a1fa961daa8391edf289e7a0d76f055af591c873f7b9215b9c2224cb

                  SHA512

                  0ef7dc4a992dae6fe8b59addbafebdf1cc1d2fdf13b33a4e09d0740718bb61d2a8ccfd19eb505e00f119bfe266fac800a0dc541d2d5eefe29ea68cc693619160

                • F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\_desktop.ini

                  Filesize

                  9B

                  MD5

                  fa1e1ef0fdda97877a13339b28fa95e5

                  SHA1

                  7e2cffca41118e7b2d62963bd940630b15b85653

                  SHA256

                  968b715c081472526487d60da8968e9b3bde2dac103f69beb3f6abe6ef7bc191

                  SHA512

                  3d55913a97aa89a7201342705640c1d031d19ad8aca4939219067f84e3fe118f47b4e388f490f69f605683d3854425c3de188f731886405474ae8e3d42c86f4f

                • memory/2252-18-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2252-3217-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2252-11-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/2252-8642-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/4608-0-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB

                • memory/4608-10-0x0000000000400000-0x000000000043D000-memory.dmp

                  Filesize

                  244KB