Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 22:29

General

  • Target

    10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe

  • Size

    491KB

  • MD5

    5eabd48682e009f3956c6740cfd9e393

  • SHA1

    54ad6044b7db8a7f43edbed592fe42ad60c694ce

  • SHA256

    10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef

  • SHA512

    6c14299744431ebe2573e10c2ca0117b063933e61a0f3c5d5102011d1ad0fe7fa8c0100f97700cfd4ed13a18868114c44f74662c6a18ba4ed91b157466fbf44a

  • SSDEEP

    6144:k46tGdyPz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fa2:k3Nb1gL5pRTcAkS/3hzN8qE43fm78V

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
        "C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2880
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a81C.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1364
            • C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
              "C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"
              4⤵
              • Executes dropped EXE
              PID:2600
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2804
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2692
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2588
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2640
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2716

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            dabffb38234f007c501cf88551471dfe

            SHA1

            ea9f4c4f46ffd3cb73b767b729c62cfcca6a065c

            SHA256

            f4126de53afbb2a68dead67d01bae1d52b38ae711b06d94629f952099e691d32

            SHA512

            02229668f14c8057849b6e0babac2a5369e904178d8ac2ae5ac5dcff2ea659f4765b1590a4fe482165a4b2de7da43cb80c040befdf0410b3837ef7dfc915b6cf

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            db30f5e16c744915af12c09f1ccf3e41

            SHA1

            d5feb47e0ca1c47b0a4cfc90be501e97f613ce90

            SHA256

            cfc87b2273f90e5125ca09d4fed15c56a82dabc54e418301f8ce23476201950e

            SHA512

            ff466c60abd62f72cbe687d48fcc485855e0df65599da37112d3872324176bf68428c312d8fbfaf20deba2295b2c7fc51129436a73ba8bdc58836289f6a47f6b

          • C:\Users\Admin\AppData\Local\Temp\$$a81C.bat

            Filesize

            721B

            MD5

            07e791a90d03d8c98af4f75bf4cbf16c

            SHA1

            a5cb255b5e7030a762961180cf9e4e682e7cc96b

            SHA256

            666224e8072a5a5765f69c71b102bca37cb658ee7aeb44a8ba0b11a591989954

            SHA512

            3d1bc1f65aff2f6bd561e9bb91df2a7f6854d05d5d900b7505f5873de45cf5b82979854480c0a4e114b02e86a50cd753af35de6a946cd29e99eb69bed1bd8baa

          • C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe.exe

            Filesize

            458KB

            MD5

            619f7135621b50fd1900ff24aade1524

            SHA1

            6c7ea8bbd435163ae3945cbef30ef6b9872a4591

            SHA256

            344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

            SHA512

            2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            7514021d14a754dd434e4b38cb87ae3d

            SHA1

            3ea156bdfea7751e851cf281b20783f3f9a4784d

            SHA256

            cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf

            SHA512

            78ccfd339f3d905c1e8cb072951164f6b66407b1928fa2879b53c015a89c5027e2e10f81912bf21464b35d650750da811f0975084cf91b710dd6ead8a1d90308

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            832B

            MD5

            7e3a0edd0c6cd8316f4b6c159d5167a1

            SHA1

            753428b4736ffb2c9e3eb50f89255b212768c55a

            SHA256

            1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

            SHA512

            9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

          • F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

            Filesize

            8B

            MD5

            af485d3db9f82d3e5bdc8c6d87fb742e

            SHA1

            f879c3dbd3d34e9789ff73896508bfbeabbf7468

            SHA256

            7a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759

            SHA512

            d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360

          • memory/1256-29-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

            Filesize

            4KB

          • memory/2180-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2180-18-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2804-33-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2804-19-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2804-3281-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2804-4086-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB