Malware Analysis Report

2024-11-30 06:51

Sample ID 240603-jc2a8ahc96
Target 4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a
SHA256 4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a

Threat Level: Shows suspicious behavior

The file 4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Deletes itself

Executes dropped EXE

Reads user/profile data of web browsers

Drops startup file

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 07:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 07:32

Reported

2024-06-03 07:34

Platform

win7-20240221-en

Max time kernel

150s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Logo1_.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\or\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Uninstall Information\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre7\lib\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 2844 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 2844 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 2844 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 3052 wrote to memory of 2372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3052 wrote to memory of 2372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3052 wrote to memory of 2372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3052 wrote to memory of 2372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2844 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 2844 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 2844 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 2844 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 2564 wrote to memory of 2864 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2864 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2864 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2864 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2864 wrote to memory of 2568 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2864 wrote to memory of 2568 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2864 wrote to memory of 2568 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2864 wrote to memory of 2568 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2564 wrote to memory of 2852 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2852 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2852 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2852 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2852 wrote to memory of 2696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2852 wrote to memory of 2696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2852 wrote to memory of 2696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2852 wrote to memory of 2696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2564 wrote to memory of 1248 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2564 wrote to memory of 1248 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe

"C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$a21A4.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

N/A

Files

memory/2844-0-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a21A4.bat

MD5 f4db0236b53dad71f56003a6dc546b96
SHA1 61f7a12b55eaa46d7e6c52c68683368c1201563e
SHA256 0b6d00e32cd1ccdeeb0f97aae271226e5713c9f20be0652754b8e3e363392ec5
SHA512 79faa306d4cbf9c9d7df6ebff05ddb78a1c525c6283c6a746e324639784a38ff744355f8fa3dff2a3ee74978191c1f31fd91c70582ba3b4822aec7e9c690f91b

C:\Windows\Logo1_.exe

MD5 f5a21d2ae39e85a9b986aa3060965b87
SHA1 b22d04580bfbcbc846d18f96ba92018cb1a8138a
SHA256 3e02caf1f845080b75cf865164adfa1c4855d5b6cab6af1664a97c37f3bab646
SHA512 e0bfbe521ca648fe2dabe227235e758d5663c8573440df8b9217f033cb005aaa7b802f7ad9d85bbedaef0ce73503f7a82923623d25483d4d665b0495fcfd5c6f

memory/2564-18-0x0000000000400000-0x000000000043D000-memory.dmp

memory/2844-16-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

memory/1248-25-0x0000000002550000-0x0000000002551000-memory.dmp

memory/2564-29-0x0000000000400000-0x000000000043D000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\_desktop.ini

MD5 a6f28952c332969f9e6d9f7d1a449737
SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 f44aac5207fae774b320093a814fe8ce
SHA1 836a7d71f3853f69ea12919a7d5289fac24cb241
SHA256 666ca0e926bc557503309ada0633c33844d0feb048c815c503f381a0bf6ebddc
SHA512 ae387ac2a8dc838c30cb1869eca33c63d4a0a03d0e6d20ffe65650846abf55fe18d22599cd94747595ceaa27b802d3505230c4a0469cabd3037ee761215aa500

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 5e54b5419052a6321d15fe6088be5258
SHA1 420003c0ad68fa2b977bee9e2ca2d1a53f8f1ec2
SHA256 142a70f95c82ea8acba8d3550273a20411a5b82f6d1b1c9657db51c3f83d5d97
SHA512 6d2d2025ed17d6f730d3fbb3a5549e60cfe951c7d9e0063f4ecca045ee28a375eac11fb9aa9cc484b181369165a0f7abae967807bad16aac0e4b60b7a8092f71

memory/2564-3276-0x0000000000400000-0x000000000043D000-memory.dmp

memory/2564-4091-0x0000000000400000-0x000000000043D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 07:32

Reported

2024-06-03 07:34

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Logo1_.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 932 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 932 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 932 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 3616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 788 wrote to memory of 3616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 788 wrote to memory of 3616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 932 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 932 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 932 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe C:\Windows\Logo1_.exe
PID 5000 wrote to memory of 4012 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5000 wrote to memory of 4012 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5000 wrote to memory of 4012 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 4012 wrote to memory of 2128 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4012 wrote to memory of 2128 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4012 wrote to memory of 2128 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 5000 wrote to memory of 2748 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5000 wrote to memory of 2748 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5000 wrote to memory of 2748 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2748 wrote to memory of 2024 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2024 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2024 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 5000 wrote to memory of 3532 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 5000 wrote to memory of 3532 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe

"C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3894.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/932-0-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Windows\Logo1_.exe

MD5 f5a21d2ae39e85a9b986aa3060965b87
SHA1 b22d04580bfbcbc846d18f96ba92018cb1a8138a
SHA256 3e02caf1f845080b75cf865164adfa1c4855d5b6cab6af1664a97c37f3bab646
SHA512 e0bfbe521ca648fe2dabe227235e758d5663c8573440df8b9217f033cb005aaa7b802f7ad9d85bbedaef0ce73503f7a82923623d25483d4d665b0495fcfd5c6f

memory/5000-11-0x0000000000400000-0x000000000043D000-memory.dmp

memory/932-9-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4ea042828218a3a418b0ab737b7aeafb3612e7137aba20c239c44d07724c188a.exe.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Temp\$$a3894.bat

MD5 72f01c31c07dd71738032f828c1ac553
SHA1 b6ba4c9b7a46b860d97a2e6002e82df7a457b145
SHA256 d19e656a0802d5830b5e4d72612495d71d4f4c7d64d5a1ffe9caf9735efe0c96
SHA512 bbe75ccdae3bbf22da7092db265e65c20d8e73b66bed399098ab449efcd95268c06a573a2045c26f25579fd8e81db1b01a3098cb467c8f4b73a5bc0298a8f6ed

memory/5000-17-0x0000000000400000-0x000000000043D000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-4018855536-2201274732-320770143-1000\_desktop.ini

MD5 a6f28952c332969f9e6d9f7d1a449737
SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac

C:\Program Files\7-Zip\7z.exe

MD5 0e6d500107143697bcfba9450bc17c82
SHA1 f54f6251aa1f02777459466a0311ac093b2af7ef
SHA256 07481182a1f0952663948dc601a4532f1ed257cb853bc032c0557173040e995c
SHA512 6abb4b37772a348cec7cef9ee5d44b8bc0ebbce167029a2da2d6547df202315c3c334580d4ca26f36bc820d8d967dd8b987f791869090cfe60ac19a6bd38fbc2

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 f44aac5207fae774b320093a814fe8ce
SHA1 836a7d71f3853f69ea12919a7d5289fac24cb241
SHA256 666ca0e926bc557503309ada0633c33844d0feb048c815c503f381a0bf6ebddc
SHA512 ae387ac2a8dc838c30cb1869eca33c63d4a0a03d0e6d20ffe65650846abf55fe18d22599cd94747595ceaa27b802d3505230c4a0469cabd3037ee761215aa500

memory/5000-5175-0x0000000000400000-0x000000000043D000-memory.dmp

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

MD5 9363a720e098b38389b25a7b18cfbcdd
SHA1 7b5e835b22262b47e6042e7aadecc67dac05f7db
SHA256 10579b661dade8697f252204f241952eb2029ea6978165f9336fd60a72b3205e
SHA512 564b873358ebe4d4d194b924e9934cb5c1666df901db2556e8cbab8276f8c4380a5bee157cc8eb2063fe0f48a1d0dc1cf339d3d3040d764c974e1c46b0870f88

memory/5000-8655-0x0000000000400000-0x000000000043D000-memory.dmp