938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
Size 5.7MB
Sample240609-xdfykaed35
SHA256 938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70
MD5 d827d9fd4ae521b2b7a166d1cd4f2112
SHA1 e105a3228fdbaf52bf262673e3ea991d18ac6673
SHA512 62e55e80580f128b049c5400edbcaab59cef6727d8a58d054169cc636edb3578f1f73645b433fc057cce4b14cce29d3bbfd9d77a8cac9b398f80f1fb634fcb92
SSDEEP 49152:eKPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:esKUgTH2M2m9UMpu1QfLczqssnKSk
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
4928	Logo1_.exe
1332	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
File created	C:\Windows\Logo1_.exe	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe
4928	Logo1_.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 968	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	82
PID 3596 wrote to memory of 968	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	82
PID 3596 wrote to memory of 968	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	82
PID 968 wrote to memory of 3368	968	net.exe	84
PID 968 wrote to memory of 3368	968	net.exe	84
PID 968 wrote to memory of 3368	968	net.exe	84
PID 3596 wrote to memory of 5060	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	88
PID 3596 wrote to memory of 5060	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	88
PID 3596 wrote to memory of 5060	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	88
PID 3596 wrote to memory of 4928	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	89
PID 3596 wrote to memory of 4928	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	89
PID 3596 wrote to memory of 4928	3596	938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe	89
PID 4928 wrote to memory of 4572	4928	Logo1_.exe	91
PID 4928 wrote to memory of 4572	4928	Logo1_.exe	91
PID 4928 wrote to memory of 4572	4928	Logo1_.exe	91
PID 4572 wrote to memory of 1212	4572	net.exe	94
PID 4572 wrote to memory of 1212	4572	net.exe	94
PID 4572 wrote to memory of 1212	4572	net.exe	94
PID 4928 wrote to memory of 3284	4928	Logo1_.exe	97
PID 4928 wrote to memory of 3284	4928	Logo1_.exe	97
PID 4928 wrote to memory of 3284	4928	Logo1_.exe	97
PID 3284 wrote to memory of 3892	3284	net.exe	99
PID 3284 wrote to memory of 3892	3284	net.exe	99
PID 3284 wrote to memory of 3892	3284	net.exe	99
PID 4928 wrote to memory of 3436	4928	Logo1_.exe	55
PID 4928 wrote to memory of 3436	4928	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
  "C:\Users\Admin\AppData\Local\Temp\938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B13.bat
    3⤵
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe
      "C:\Users\Admin\AppData\Local\Temp\938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe"
      4⤵
      Executes dropped EXE
      PID:1332
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1212
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 258KB
SHA256 7fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
MD5 256b0680af798047a835349001fd7c41
SHA1 4e43e0268f7f67c341189b7a1ce6c2baa063cb19
SHA512 9564596dffff045aa64d145c6f06951d55dc95d1efaf64be425b1c94cfdb205c13264cf4f27fb3bae5e3e75c32d5fe591d1f92bd4b0d7f9ea279862b78530957
SSDEEP 6144:o46tGfC0jJgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:o3WFj2itXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 577KB
SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
MD5 11ad98d96a68eab26bb4077d6fe66965
SHA1 2c2bb45a1fc2d876092eb437c4b663408a94c3eb
SHA512 f5c1da49e728f1952a04ff6a1fc8afcc643db62151d28d728f08cd7b2b8591e7c9826086d467c1204215df828e34b5c881426e6931eb367705d1de74431e67c5
SSDEEP 6144:e46tGfC0jcE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4tR:e3WFjn7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
MD5 0eec0543603f7a8ce8e8f5fee478e1d2
SHA1 f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA512 cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
SSDEEP 12288:QR3WFjV5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:k3Mh5mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a4B13.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4B13.bat
Size 722B
SHA256 1efacb1de1409771c604a031adc93d46a768e11985912c5450faa0158ee46f80
MD5 b346bafa193a00fcb37ac4e46ee59156
SHA1 5d2156a060dce42ac5afc1f565839205574f4454
SHA512 237d1365e6331f8762cf6b185345f17961b5b2b6abd85cac6a8e4cd32610548333defbd41b3fed77c4ef445f5a242613b88b989991b2c55939b37f135c11e77a
MD5 SHA1 SHA512

Submit Download

938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\938da0723e986bd4b5a818066f5914ed436ca2a0b6a80d31185f8093c6573a70.exe.exe
Size 5.7MB
SHA256 f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
MD5 ba18e99b3e17adb5b029eaebc457dd89
SHA1 ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA512 1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
SSDEEP 49152:BPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:NKUgTH2M2m9UMpu1QfLczqssnKSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 0f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
MD5 0fbf02d223445d573f072dd264ff499c
SHA1 a7c8f8fbbafa35ae853394f9b0e6436661b7b1cb
SHA512 4708c6abc6b615c0537f6f67d7c73a35f9e013220f8798c24cfc2007a51ab7443e143a942ecf6fee90705043e58ab97c1df800a5ddec2da9a10ce8e9d5248fb4
SSDEEP 768:J2MUElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:JUaYzMXqtGN/CstC9qVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\_desktop.ini
Size 8B
SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
MD5 9bf5ad0e8bbf0ba1630c244358e5c6dd
SHA1 25918532222a7063195beeb76980b6ec9e59e19a
SHA512 7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3
MD5 SHA1 SHA512

Submit Download

memory/3596-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3596-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-3181-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-8634-0x0000000000400000-0x000000000043E000-memory.dmp

Download