Analysis

  • max time kernel
    100s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 06:34

General

  • Target

    c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4.exe

  • Size

    383KB

  • MD5

    b1372b6597ab5020cf03ccfe6ac47903

  • SHA1

    428b31e9082cd1e00899c24533f700f3ce50ed31

  • SHA256

    c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4

  • SHA512

    6f51363bb8a7edf24699a07157d2892356bac1071b3ba8b220e5118164ef571e511844df23e98cc5dcd98c65d6ff80508df8c86756bacdcd01eea9967912dae7

  • SSDEEP

    6144:nVfjmNKJlrpfX7TME2xdQ1LziCOONeswO/xVn84f:V7+CPXsdWzimJ/P8o

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1180
      • C:\Users\Admin\AppData\Local\Temp\c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4.exe
        "C:\Users\Admin\AppData\Local\Temp\c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a770.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Users\Admin\AppData\Local\Temp\c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4.exe
            "C:\Users\Admin\AppData\Local\Temp\c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4.exe"
            4⤵
            • Executes dropped EXE
            PID:2608
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2140
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2732

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

              Filesize

              251KB

              MD5

              f94afa1cae163777a4ead07058d9b026

              SHA1

              f9076e8e06e3f5eaf76ce771473be0b0045fc3e9

              SHA256

              cd34b8f29d1c48674d4079c529efef3554200bfcef576bb55a2e3f03ce0f2362

              SHA512

              54be6fb01f76381ecde1f9cbe7d8d80f23622833bd89e6cfd3506942aa19387acf77c9b96fb6b3375f83158c51c2b6369071a155cb084f2f92cc4ae3286c4f18

            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

              Filesize

              406KB

              MD5

              1c7f180659025e4a57f27c45015022bb

              SHA1

              78d0c244f42c5bba7abc5d6082713eeb6011a2bb

              SHA256

              c1868d38f399e7bf79fbc3632f93ffa69c469f6b21f47cb09b09b8c4adee1193

              SHA512

              5ffda000335fd86e1e65d82babf5eb352a4ad868950d9b2f8e363154066239780293fe89a8746c51b3f353c4e4b2dbd78ec6f6c2fa2dafe73e76dacb5422786d

            • C:\Users\Admin\AppData\Local\Temp\$$a770.bat

              Filesize

              721B

              MD5

              91b1d997f1a8d9e617c446c99b8f6353

              SHA1

              53b9d9833c7889b2f03ccd87ca955a1b094a3eb5

              SHA256

              d9e69fb110bf78feaf5793f3a4a5751a779c0dd1b9e5b51b5fb633f3755fb778

              SHA512

              b7a98f3a318abcff58c53b9293b0ea6db48fa989bdbe633d590dae13868eebd3d7cc7eaf0f77ba51e39580e1fa42b460e19a1c03915a11df7fa63cab1f30b8f7

            • C:\Users\Admin\AppData\Local\Temp\c4387172b5c812b26ca2d7055541a73822b88ca284945aa7956655903d0739a4.exe.exe

              Filesize

              357KB

              MD5

              27d23ccc82e864992f272c4e04609074

              SHA1

              328a01ecd907aaa0f95ae1493b3d8bc28525ffdb

              SHA256

              b413c90fbf077c9482c3ccf49be8a802883818d6d4240e0526b2cce88e520121

              SHA512

              f1b54de6766fe0ffc221697e8a17f92c953d3c65d64a7b80e2b8d16dc12774f3a65274b0f241e2c081e44987c96dee9f82873f093742ce2018f765e5800a4b85

            • C:\Windows\Logo1_.exe

              Filesize

              26KB

              MD5

              d1bd53e7079e1416e563b6787c74f3f8

              SHA1

              dfbb7850f591cc74bcbe86418b5ef11522e9e7b0

              SHA256

              b4a3413d2027dc45862a0959c413db5f6b7e932c3c61660c2c3df78804d1db2e

              SHA512

              bacb9edc071341e8ea9dfd8309126f1bc29dbcc9b0cb4a9212b9ad6f6381bc2aae8f9c300eeb3e17e1519d90456e651270e316497daa5ed0f23b69a10fdd129f

            • F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini

              Filesize

              9B

              MD5

              60b1ffe4d5892b7ae054738eec1fd425

              SHA1

              80d4e944617f4132b1c6917345b158f3693f35c8

              SHA256

              5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

              SHA512

              7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

            • memory/1180-31-0x0000000002E10000-0x0000000002E11000-memory.dmp

              Filesize

              4KB

            • memory/1732-17-0x00000000020A0000-0x00000000020D4000-memory.dmp

              Filesize

              208KB

            • memory/1732-16-0x00000000020A0000-0x00000000020D4000-memory.dmp

              Filesize

              208KB

            • memory/1732-15-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1732-0-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-98-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-46-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-92-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-40-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-531-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-1875-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-19-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-2515-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-3335-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2140-33-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB