ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
Size 5.7MB
Sample240603-tz3gxade83
SHA256 ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627
MD5 b4d3bf80c69663401819d925f115c121
SHA1 9706b8299cd78c1e6ba863293666c014d112e6b6
SHA512 de03efea082f3245afacccc70582bcadc5467731d046ae112c1c01159002a454adffda6b992516bb802b72204cbcd08200a3c5077b3cf54b2dbc46ac82269f83
SSDEEP 49152:rKPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:rsKUgTH2M2m9UMpu1QfLczqssnKSk
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2340	Logo1_.exe
3264	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
File created	C:\Windows\Logo1_.exe	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe
2340	Logo1_.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4516	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	84
PID 4360 wrote to memory of 4516	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	84
PID 4360 wrote to memory of 4516	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	84
PID 4516 wrote to memory of 2188	4516	net.exe	87
PID 4516 wrote to memory of 2188	4516	net.exe	87
PID 4516 wrote to memory of 2188	4516	net.exe	87
PID 4360 wrote to memory of 1760	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	90
PID 4360 wrote to memory of 1760	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	90
PID 4360 wrote to memory of 1760	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	90
PID 4360 wrote to memory of 2340	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	91
PID 4360 wrote to memory of 2340	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	91
PID 4360 wrote to memory of 2340	4360	ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe	91
PID 2340 wrote to memory of 4936	2340	Logo1_.exe	92
PID 2340 wrote to memory of 4936	2340	Logo1_.exe	92
PID 2340 wrote to memory of 4936	2340	Logo1_.exe	92
PID 4936 wrote to memory of 5008	4936	net.exe	94
PID 4936 wrote to memory of 5008	4936	net.exe	94
PID 4936 wrote to memory of 5008	4936	net.exe	94
PID 2340 wrote to memory of 4560	2340	Logo1_.exe	97
PID 2340 wrote to memory of 4560	2340	Logo1_.exe	97
PID 2340 wrote to memory of 4560	2340	Logo1_.exe	97
PID 4560 wrote to memory of 4960	4560	net.exe	99
PID 4560 wrote to memory of 4960	4560	net.exe	99
PID 4560 wrote to memory of 4960	4560	net.exe	99
PID 2340 wrote to memory of 3488	2340	Logo1_.exe	56
PID 2340 wrote to memory of 3488	2340	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
  "C:\Users\Admin\AppData\Local\Temp\ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C66.bat
    3⤵
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
      "C:\Users\Admin\AppData\Local\Temp\ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe"
      4⤵
      Executes dropped EXE
      PID:3264
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:5008
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 f1ef7ece112f6d203077b1191c60aed1ba48c9d434e5b98b0198317f9e4147e0
MD5 bb32b69747d18082f2a3254122a4a4d1
SHA1 5411e6781c9fd2b47b99c92df502c4f3a91f8e6c
SHA512 5b7df3c51ba6683bc0bbbca996a2a3735294437f2b1997dfa771368e45e32d278c600a32d8bcc35e37b179e9bcf8a938ced363043514e32929a400f4ec18a64c
SSDEEP 6144:s46tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:s3WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 55a9b4b5c43c8a630edf8e30c95072302c460727dc8e1e0c020682e87d0ae5c1
MD5 4bfee4f0dff19b0415f542bb0f4c4881
SHA1 424e2d74d74ec0d1d31175162bf9673a51c00b31
SHA512 132969c99717dbcbee1a1dc0d00b7fefe70218358faf5ae4af9fabbe40fb8c261044330bb5c750c69efc942e90c477559f9a51394f3402f1e388c1401f8205b3
SSDEEP 6144:r46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:r3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 c29e1871d4cdc7c671f96eee5a2961346f30617603e4eef7323f2fe4761fd38d
MD5 5f3e0c481a5b3ae08bd3f68d796e57c5
SHA1 0500e07056a4780b8ab1ad5ae7b302d73176e7b9
SHA512 2a747c3369608e0f61c79605449c250d4a4e48848a7249ecc42eb32ca7a82141cbcb51ca8de75ee739eb4ce54232759834f2225c4e0a9ecd7dd5bf721649f48d
SSDEEP 12288:QF3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a6C66.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6C66.bat
Size 722B
SHA256 916a56ac31b8ac017e6a9d94cc1bb3b043887606c2bd4f1119329e9da45ee7cf
MD5 6d9c9090c5bde0c12dae6b000fd2fd12
SHA1 492a29f15e6d8b7a5336c80263e4574a27f659c7
SHA512 0814428ade219e4c5a3e077abde4a788bb9a00c17d17e0100ab5ed16cccb6c5cb48e9ec6e2972c375aeac4da08323e191dc18f91041f09632dd22959fd2f7c3b
MD5 SHA1 SHA512

Submit Download

ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe

Path C:\Users\Admin\AppData\Local\Temp\ad0b1f2cbb4d4f746cb803f6b2f3d59f43831f737d3e4fcf6ef6371795514627.exe
Size 5.7MB
SHA256 f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
MD5 ba18e99b3e17adb5b029eaebc457dd89
SHA1 ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA512 1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
SSDEEP 49152:BPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:NKUgTH2M2m9UMpu1QfLczqssnKSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 8736ed7b42035f65515a84b24ccd12302af3732a51e5690888626dc7e9ae98dd
MD5 410231d765e76f7cb887470e800892aa
SHA1 cd26f76f7ddd76cdc45268cfb5dd4a153846b29c
SHA512 dd058433257f751369bc0677a23719066ad7675ecb6140329d932c0b1c1c2aba5c9148c24f0070433b8d180795679867a5819cca5d6d04687b6ef3f2bc3a5e92
SSDEEP 768:J7ElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:J7aYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
Size 8B
SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
MD5 a6f28952c332969f9e6d9f7d1a449737
SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
MD5 SHA1 SHA512

Submit Download

memory/2340-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-8690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download