9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
Size 717KB
Sample240609-v2w9cach7v
SHA256 9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6
MD5 774813b8a6371268e15ec6744e28f189
SHA1 a6139c4789375aa5b644aa005bb7b55086c00d84
SHA512 4922f5dfabaa363e4e336b493db77a8dc5ea6ee42d0cd65c1154b8ff2448132f48c92471422b40353c1a76e2395d7dd494f0e6498780c1fff7219c5b0987439d
SSDEEP 12288:F3WFjJfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:F3M9LOS2opPIXV
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2836	Logo1_.exe
2028	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
File created	C:\Windows\Logo1_.exe	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4640	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	80
PID 2968 wrote to memory of 4640	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	80
PID 2968 wrote to memory of 4640	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	80
PID 4640 wrote to memory of 4592	4640	net.exe	82
PID 4640 wrote to memory of 4592	4640	net.exe	82
PID 4640 wrote to memory of 4592	4640	net.exe	82
PID 2968 wrote to memory of 4632	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	83
PID 2968 wrote to memory of 4632	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	83
PID 2968 wrote to memory of 4632	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	83
PID 2968 wrote to memory of 2836	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	84
PID 2968 wrote to memory of 2836	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	84
PID 2968 wrote to memory of 2836	2968	9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe	84
PID 2836 wrote to memory of 4472	2836	Logo1_.exe	85
PID 2836 wrote to memory of 4472	2836	Logo1_.exe	85
PID 2836 wrote to memory of 4472	2836	Logo1_.exe	85
PID 4472 wrote to memory of 2664	4472	net.exe	88
PID 4472 wrote to memory of 2664	4472	net.exe	88
PID 4472 wrote to memory of 2664	4472	net.exe	88
PID 4632 wrote to memory of 2028	4632	cmd.exe	89
PID 4632 wrote to memory of 2028	4632	cmd.exe	89
PID 2836 wrote to memory of 1004	2836	Logo1_.exe	92
PID 2836 wrote to memory of 1004	2836	Logo1_.exe	92
PID 2836 wrote to memory of 1004	2836	Logo1_.exe	92
PID 1004 wrote to memory of 4576	1004	net.exe	94
PID 1004 wrote to memory of 4576	1004	net.exe	94
PID 1004 wrote to memory of 4576	1004	net.exe	94
PID 2836 wrote to memory of 3592	2836	Logo1_.exe	56
PID 2836 wrote to memory of 3592	2836	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3592
- C:\Users\Admin\AppData\Local\Temp\9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
  "C:\Users\Admin\AppData\Local\Temp\9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B44.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe
      "C:\Users\Admin\AppData\Local\Temp\9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe"
      4⤵
      Executes dropped EXE
      PID:2028
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2664
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 20b8813493fa940a34f16c61f9d03b8640df98064d3c3d5c4b8096d121a320ba
MD5 117953447e5ae2643f80661c4a3b58dc
SHA1 9b7c7a2b906858319d8e65e1b10d8ecd330cbfce
SHA512 55dabab54387e45ac41328a6b90d505fa66ee0e8f409c3687f81508ccf8897fa01d50b05efa5d588a2a70088da2b505882b44b5450965699c70a10237e4a19d9
SSDEEP 6144:646tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:63WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 eb3da19192dc81a22fad210736bde526626033bf1176031183fd69551f11c720
MD5 fa676c5b6ed8f9336cc9f1ff9c59efa9
SHA1 aba6753d4f48539008622635b53539bde9b497ea
SHA512 596f9f9e83e2f0899d7ce7e5f657af814d15648546bc3713c644e86de070e7dfbbcf9c1ad7acc0e3310fb00f297f7f9b0b8ea7de301a6712a8786d962596a96b
SSDEEP 6144:F46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:F3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
MD5 0eec0543603f7a8ce8e8f5fee478e1d2
SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a3B44.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3B44.bat
Size 722B
SHA256 3caa2154fbb4ff1f809f288ed1a060a7b02834af58fcecbaa70f84473135f8c4
MD5 496c930fe3fa6f741b198aab960b5334
SHA1 e4d41814198fec8a09ef5cb1094e1b5d39a38cd6
SHA512 fb1fe8bbe436919b1d701fb3d1ad160eda923c7d3d6a5b9fbb0859388b6477628e0b5bc8ea6ab512a49ee1896696341a0097e3f7d611520648f4531929dff37b
MD5 SHA1 SHA512

Submit Download

9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\9cd2c19a90d6bec9a15efd98d35bdc43d57d4459f51f416140e129fd1d29bcd6.exe.exe
Size 684KB
SHA256 b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
MD5 50f289df0c19484e970849aac4e6f977
SHA1 3dc77c8830836ab844975eb002149b66da2e10be
SHA512 877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
SSDEEP 12288:ffC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:3LOS2opPIXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 c55667dfc241510c705ae18a591bd521fdb6f4532ff362a49d8f4c17eb1f9975
MD5 71fef4697aa2b93f4407649582c6c8ba
SHA1 42fb512a17b70212bec3096673d983403ec7f8e6
SHA512 efb7d15521b285ba6921a11d3fe830ee457eadff6896f623836b1bf1c7d9f541a2e3b031635034008112f6071fb742cb33cbfc26c7dc43ed347a6d34b16e1c29
SSDEEP 768:JPMUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JFaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1162180587-977231257-2194346871-1000\_desktop.ini
Size 8B
SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
SHA1 25918532222a7063195beeb76980b6ec9e59e19a
SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
MD5 SHA1 SHA512

Submit Download

memory/2836-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-5178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-8663-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2968-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2968-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download