Malware Analysis Report

2025-04-14 01:48

Sample ID 240602-2efreaad88
Target 10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef
SHA256 10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef
Tags
spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef

Threat Level: Likely malicious

The file 10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef was found to be: Likely malicious.

Malicious Activity Summary

spyware stealer

Drops file in Drivers directory

Deletes itself

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 22:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 22:29

Reported

2024-06-02 22:32

Platform

win7-20231129-en

Max time kernel

150s

Max time network

123s

Command Line

C:\Windows\Explorer.EXE

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\Logo1_.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2180 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 2180 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 2180 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 2180 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 1812 wrote to memory of 2880 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1812 wrote to memory of 2880 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1812 wrote to memory of 2880 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1812 wrote to memory of 2880 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2180 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 2180 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 2180 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 2180 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 2804 wrote to memory of 2692 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2804 wrote to memory of 2692 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2804 wrote to memory of 2692 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2804 wrote to memory of 2692 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1364 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
PID 1364 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
PID 1364 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
PID 1364 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
PID 2692 wrote to memory of 2588 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2692 wrote to memory of 2588 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2692 wrote to memory of 2588 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2692 wrote to memory of 2588 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2804 wrote to memory of 2640 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2804 wrote to memory of 2640 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2804 wrote to memory of 2640 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2804 wrote to memory of 2640 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2640 wrote to memory of 2716 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2640 wrote to memory of 2716 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2640 wrote to memory of 2716 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2640 wrote to memory of 2716 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2804 wrote to memory of 1256 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2804 wrote to memory of 1256 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe

"C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$a81C.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe

"C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

N/A

Files

memory/2180-0-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a81C.bat

MD5 07e791a90d03d8c98af4f75bf4cbf16c
SHA1 a5cb255b5e7030a762961180cf9e4e682e7cc96b
SHA256 666224e8072a5a5765f69c71b102bca37cb658ee7aeb44a8ba0b11a591989954
SHA512 3d1bc1f65aff2f6bd561e9bb91df2a7f6854d05d5d900b7505f5873de45cf5b82979854480c0a4e114b02e86a50cd753af35de6a946cd29e99eb69bed1bd8baa

C:\Windows\Logo1_.exe

MD5 7514021d14a754dd434e4b38cb87ae3d
SHA1 3ea156bdfea7751e851cf281b20783f3f9a4784d
SHA256 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf
SHA512 78ccfd339f3d905c1e8cb072951164f6b66407b1928fa2879b53c015a89c5027e2e10f81912bf21464b35d650750da811f0975084cf91b710dd6ead8a1d90308

memory/2804-19-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2180-18-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 7e3a0edd0c6cd8316f4b6c159d5167a1
SHA1 753428b4736ffb2c9e3eb50f89255b212768c55a
SHA256 1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c
SHA512 9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

memory/1256-29-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

memory/2804-33-0x0000000000400000-0x000000000043E000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

MD5 af485d3db9f82d3e5bdc8c6d87fb742e
SHA1 f879c3dbd3d34e9789ff73896508bfbeabbf7468
SHA256 7a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759
SHA512 d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 dabffb38234f007c501cf88551471dfe
SHA1 ea9f4c4f46ffd3cb73b767b729c62cfcca6a065c
SHA256 f4126de53afbb2a68dead67d01bae1d52b38ae711b06d94629f952099e691d32
SHA512 02229668f14c8057849b6e0babac2a5369e904178d8ac2ae5ac5dcff2ea659f4765b1590a4fe482165a4b2de7da43cb80c040befdf0410b3837ef7dfc915b6cf

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 db30f5e16c744915af12c09f1ccf3e41
SHA1 d5feb47e0ca1c47b0a4cfc90be501e97f613ce90
SHA256 cfc87b2273f90e5125ca09d4fed15c56a82dabc54e418301f8ce23476201950e
SHA512 ff466c60abd62f72cbe687d48fcc485855e0df65599da37112d3872324176bf68428c312d8fbfaf20deba2295b2c7fc51129436a73ba8bdc58836289f6a47f6b

memory/2804-3281-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2804-4086-0x0000000000400000-0x000000000043E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 22:29

Reported

2024-06-02 22:32

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

104s

Command Line

C:\Windows\Explorer.EXE

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\Logo1_.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdate.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Defender\uk-UA\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\skins\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2748 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 2748 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 2748 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\net.exe
PID 3840 wrote to memory of 4808 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3840 wrote to memory of 4808 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3840 wrote to memory of 4808 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 2748 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 2748 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe C:\Windows\Logo1_.exe
PID 1240 wrote to memory of 3340 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1240 wrote to memory of 3340 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1240 wrote to memory of 3340 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 3340 wrote to memory of 2456 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3340 wrote to memory of 2456 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3340 wrote to memory of 2456 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2240 wrote to memory of 3388 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
PID 2240 wrote to memory of 3388 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe
PID 1240 wrote to memory of 2904 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1240 wrote to memory of 2904 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1240 wrote to memory of 2904 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2904 wrote to memory of 2848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2904 wrote to memory of 2848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2904 wrote to memory of 2848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1240 wrote to memory of 3416 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 1240 wrote to memory of 3416 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe

"C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3662.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe

"C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp

Files

memory/2748-0-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

memory/2748-11-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Windows\Logo1_.exe

MD5 7514021d14a754dd434e4b38cb87ae3d
SHA1 3ea156bdfea7751e851cf281b20783f3f9a4784d
SHA256 cf2ba6f24373f440531b5ad69cf882e8ffa80a9c556124b944dad25a0d0e35bf
SHA512 78ccfd339f3d905c1e8cb072951164f6b66407b1928fa2879b53c015a89c5027e2e10f81912bf21464b35d650750da811f0975084cf91b710dd6ead8a1d90308

memory/1240-13-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a3662.bat

MD5 680726d970d83fafe3b9c7f08dfb7cae
SHA1 763d591cdf6707e51892e7e9f665ec71bdf673e4
SHA256 dcc85df225d0f662ba2d1ea31ac8411d5a15365fa7b63be89de5b25a52b63dbf
SHA512 a243d08697b14b353c1a2d078ba35b701be9cf6b9f54dc7c8e5deeae314277de0b4c62c6cd6001ac9e73bc6b9ba15b39f68f96ea86054d611b61eadd1d8ac852

C:\Users\Admin\AppData\Local\Temp\10b71c1e29e505566b0c3894ebc30a9363a3fc5a6ffd875a4dff7f762155b3ef.exe.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

memory/1240-20-0x0000000000400000-0x000000000043E000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini

MD5 af485d3db9f82d3e5bdc8c6d87fb742e
SHA1 f879c3dbd3d34e9789ff73896508bfbeabbf7468
SHA256 7a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759
SHA512 d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360

C:\Program Files\7-Zip\7z.exe

MD5 f265293c315bc70d499702dcea4b1ac7
SHA1 dbd3e1030298ee731025e776c46948adb9bb5c12
SHA256 521c916702966b6f1ba4ac9acea1e88e6af1f0f4a5c5c2af86c19a9b04e3dd52
SHA512 bf6d6616b6f632adfda964d650c6ee66c03a019dc9343b03e2dcd16ab975809f27cd03982d308a84200fa221e31bf8c2f4c25df4597efd17af204ef839796a37

memory/1240-2848-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 dabffb38234f007c501cf88551471dfe
SHA1 ea9f4c4f46ffd3cb73b767b729c62cfcca6a065c
SHA256 f4126de53afbb2a68dead67d01bae1d52b38ae711b06d94629f952099e691d32
SHA512 02229668f14c8057849b6e0babac2a5369e904178d8ac2ae5ac5dcff2ea659f4765b1590a4fe482165a4b2de7da43cb80c040befdf0410b3837ef7dfc915b6cf

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

MD5 c68e034d324260384602839c6e3295de
SHA1 add6ebe18274a2afd7756fcb2b5be590125eff7f
SHA256 8317babad7376315f76f48454d7f4057d60f2a13f0e469a7c877473b220af74f
SHA512 7c956a76088bae2a425fc13f8484027ae04bc9995b7ca85a92125801e0676ff660c2a1fcb4640424883455bc10a84d39788032d884e7b64178693b1a2a0885cb

memory/1240-8660-0x0000000000400000-0x000000000043E000-memory.dmp