Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 22:29

General

  • Target

    10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe

  • Size

    491KB

  • MD5

    5eabd48682e009f3956c6740cfd9e393

  • SHA1

    54ad6044b7db8a7f43edbed592fe42ad60c694ce

  • SHA256

    10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef

  • SHA512

    6c14299744431ebe2573e10c2ca0117b063933e61a0f3c5d5102011d1ad0fe7fa8c0100f97700cfd4ed13a18868114c44f74662c6a18ba4ed91b157466fbf44a

  • SSDEEP

    6144:k46tGdyPz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fa2:k3Nb1gL5pRTcAkS/3hzN8qE43fm78V

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
        "C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3840
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:4808
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3662.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2240
            • C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
              "C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"
              4⤵
              • Executes dropped EXE
              PID:3388
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1240
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2456
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2904
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2848

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            dabffb38234f007c501cf88551471dfe

            SHA1

            ea9f4c4f46ffd3cb73b767b729c62cfcca6a065c

            SHA256

            f4126de53afbb2a68dead67d01bae1d52b38ae711b06d94629f952099e691d32

            SHA512

            02229668f14c8057849b6e0babac2a5369e904178d8ac2ae5ac5dcff2ea659f4765b1590a4fe482165a4b2de7da43cb80c040befdf0410b3837ef7dfc915b6cf

          • C:\Program Files\7-Zip\7z.exe

            Filesize

            577KB

            MD5

            f265293c315bc70d499702dcea4b1ac7

            SHA1

            dbd3e1030298ee731025e776c46948adb9bb5c12

            SHA256

            521c916702966b6f1ba4ac9acea1e88e6af1f0f4a5c5c2af86c19a9b04e3dd52

            SHA512

            bf6d6616b6f632adfda964d650c6ee66c03a019dc9343b03e2dcd16ab975809f27cd03982d308a84200fa221e31bf8c2f4c25df4597efd17af204ef839796a37

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

            Filesize

            643KB

            MD5

            c68e034d324260384602839c6e3295de

            SHA1

            add6ebe18274a2afd7756fcb2b5be590125eff7f

            SHA256

            8317babad7376315f76f48454d7f4057d60f2a13f0e469a7c877473b220af74f

            SHA512

            7c956a76088bae2a425fc13f8484027ae04bc9995b7ca85a92125801e0676ff660c2a1fcb4640424883455bc10a84d39788032d884e7b64178693b1a2a0885cb

          • C:\Users\Admin\AppData\Local\Temp\$$a3662.bat

            Filesize

            722B

            MD5

            680726d970d83fafe3b9c7f08dfb7cae

            SHA1

            763d591cdf6707e51892e7e9f665ec71bdf673e4

            SHA256

            dcc85df225d0f662ba2d1ea31ac8411d5a15365fa7b63be89de5b25a52b63dbf

            SHA512

            a243d08697b14b353c1a2d078ba35b701be9cf6b9f54dc7c8e5deeae314277de0b4c62c6cd6001ac9e73bc6b9ba15b39f68f96ea86054d611b61eadd1d8ac852

          • C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe.exe

            Filesize

            458KB

            MD5

            619f7135621b50fd1900ff24aade1524

            SHA1

            6c7ea8bbd435163ae3945cbef30ef6b9872a4591

            SHA256

            344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

            SHA512

            2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            7514021d14a754dd434e4b38cb87ae3d

            SHA1

            3ea156bdfea7751e851cf281b20783f3f9a4784d

            SHA256

            cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf

            SHA512

            78ccfd339f3d905c1e8cb072951164f6b66407b1928fa2879b53c015a89c5027e2e10f81912bf21464b35d650750da811f0975084cf91b710dd6ead8a1d90308

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            842B

            MD5

            6f4adf207ef402d9ef40c6aa52ffd245

            SHA1

            4b05b495619c643f02e278dede8f5b1392555a57

            SHA256

            d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

            SHA512

            a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

          • F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini

            Filesize

            8B

            MD5

            af485d3db9f82d3e5bdc8c6d87fb742e

            SHA1

            f879c3dbd3d34e9789ff73896508bfbeabbf7468

            SHA256

            7a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759

            SHA512

            d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360

          • memory/1240-13-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1240-20-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1240-2848-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1240-8660-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2748-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2748-11-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB