4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
Size 33KB
Sample240603-nls4eseb52
SHA256 4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f
MD5 cb155fa097b198d3c8c93dde11a3ff5a
SHA1 55c2c08424808910e14db9c7d656d78d5751faf3
SHA512 75c63fe247b8a59611ca1d94c93319d67402abdad1eb47b2ff6d6cf106e4655e9b8b5462029d170abe52b509a461f2119df8f9548a732003192a787d941ada88
SSDEEP 768:6FpQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpa:6scx1aeg1v9OQZVUKM6+kKp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\K:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\I:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\U:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\T:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\S:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\G:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\X:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\Q:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\H:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\W:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\P:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\E:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\R:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\O:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\N:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\L:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\J:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\Z:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\Y:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened (read-only)	\??\V:	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
File created	C:\Windows\Dll.dll	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 1668	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	82
PID 716 wrote to memory of 1668	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	82
PID 716 wrote to memory of 1668	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	82
PID 1668 wrote to memory of 2996	1668	net.exe	84
PID 1668 wrote to memory of 2996	1668	net.exe	84
PID 1668 wrote to memory of 2996	1668	net.exe	84
PID 716 wrote to memory of 4232	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	88
PID 716 wrote to memory of 4232	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	88
PID 716 wrote to memory of 4232	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	88
PID 4232 wrote to memory of 3360	4232	net.exe	90
PID 4232 wrote to memory of 3360	4232	net.exe	90
PID 4232 wrote to memory of 3360	4232	net.exe	90
PID 716 wrote to memory of 3488	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	56
PID 716 wrote to memory of 3488	716	4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe
  "C:\Users\Admin\AppData\Local\Temp\4dcb9f943ffca349a670c732643349c05eede33974b805debeeeda61576d695f.exe"
  2⤵
  - Drops startup file
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2996
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 177KB
SHA256 fb8ef69b1dff5465dfd671c3c1e40e905826362fba2b60f9ef92efb6a5a022c1
MD5 5c5b9272f2d85d2db3c78b8b6ab60fe2
SHA1 fe0f767fe0562f67f77f9b1127d4ad49d7e2de41
SHA512 c4d9c70163d89725461dcf9539931024dbaaaac577dd4dda8fe4feb4c963c3f95b36b9aaa83a8679d4f39b53ecdc6d1085631620a58c96fcff9a2f0c4b4a59d8
SSDEEP 3072:6sf9lOzKM5p4DfByOpGjAvb3eLG2FmDDSrDVTFooWZet3:L1NM5pQpyOpGcj3UFmDDSrDVTSBQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 643KB
SHA256 a31829ad88d68b47eea131646207d5b3b53468a9bdd665365f608b6ce186b8ba
MD5 ab26006fce082246aa3ffd6ff4cbcf89
SHA1 f8686e05d1aeb169e13c8d3889b01dd3988d5124
SHA512 0b7f2d8dab9c10a6619970c6e0568380d79951ec942f79bc035b8c93ebe8b23d925e42b62e22aaacce6ff981fbd719526aa797031b50a036e7e6f5aef0728df5
SSDEEP 12288:D51upk5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:N1Ak5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
Size 8B
SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
MD5 a6f28952c332969f9e6d9f7d1a449737
SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
MD5 SHA1 SHA512

Submit Download

memory/716-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/716-3-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/716-2783-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/716-8647-0x0000000000400000-0x000000000043D000-memory.dmp

Download