b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b

General

Target

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Size

484KB
MD5

85a87698ab94b041f97c4829132d6173
SHA1

37da2d86b37878508d384c78302ad749b1f302cf
SHA256

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b
SHA512

7f197123662f611dc83a76d4b1b840c568f78ffaea752410558be06d170cfde53745728930c6b9e780bb299bfeb16ed36eb54629f2f7714d54be803b00b142c5
SSDEEP

6144:TVfgPRz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCG:pYR1gL5pRTcAkS/3hzN8qE43fm78V

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2256 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Logo1_.exeb40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe

pid process

1096 Logo1_.exe
2492 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2256 cmd.exe

pid	process
2256	cmd.exe

pid	process
2256	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Logo1_.exe
File created	C:\Program Files\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
File created	C:\Windows\Logo1_.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Logo1_.exe

pid	process
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe
1096	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.execmd.exenet.exe

description	pid	process	target process
PID 2072 wrote to memory of 2256	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 2072 wrote to memory of 2256	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 2072 wrote to memory of 2256	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 2072 wrote to memory of 2256	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 2072 wrote to memory of 1096	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 2072 wrote to memory of 1096	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 2072 wrote to memory of 1096	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 2072 wrote to memory of 1096	2072	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 1096 wrote to memory of 2436	1096	Logo1_.exe	net.exe
PID 1096 wrote to memory of 2436	1096	Logo1_.exe	net.exe
PID 1096 wrote to memory of 2436	1096	Logo1_.exe	net.exe
PID 1096 wrote to memory of 2436	1096	Logo1_.exe	net.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
PID 2436 wrote to memory of 2576	2436	net.exe	net1.exe
PID 2436 wrote to memory of 2576	2436	net.exe	net1.exe
PID 2436 wrote to memory of 2576	2436	net.exe	net1.exe
PID 2436 wrote to memory of 2576	2436	net.exe	net1.exe
PID 1096 wrote to memory of 1352	1096	Logo1_.exe	Explorer.EXE
PID 1096 wrote to memory of 1352	1096	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1352

C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$$a9415.bat
3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"
4⤵
- Executes dropped EXE
PID:2492

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2576

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
251KB

MD5
a8bcad95d5ae82bbd579a77cbca70d4c

SHA1
0404b31bbe8d12f77e26edfbd27573f729382e1a

SHA256
662862ac5c4edbaf8ad7483a8deb8ac06855ead35c2d9541bde22535283d3881

SHA512
ed1969e6659530edfdfae5bcab18af7558674cd6bb87b0bfb0ade77700d4c01de79e9685eceffdb48a53c5a94026f26fbdfb3de47ddb8986a07222310aa61aca

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Filesize
471KB

MD5
1a0dbecba0dbb963c2f3b0448796d47a

SHA1
5c0b5d378d3614fe984ce2915b5720886992da0c

SHA256
1ea2fb84177a921bc3df4763c3da53a970e192f93f6175d09696ded019e50cf8

SHA512
8e25dc08fa6f280a6bc1ccacb1ce665ab055b5d539f8915915fc7536c90185a221cb0c50a02d34b521b871b8487a155b9c40a5f25df87306e1df24ca7e96da25

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a9415.bat
Filesize
722B

MD5
825133af72133f07636e7bd8c06644c7

SHA1
716401b36475a23ceaa9593ba2d906060385c423

SHA256
84fae3d7c4c640278cfb0ae96b9042884a10d8da40f80913792c69e74b9f3305

SHA512
6a62348b17e09dd5198be7f5d010beb64dc2e829c4bd788a868c98ae7a80adbb12bbd2dc8103d779fcbd7466af6a0566c0b59f96fa4b002d221ceb07320219f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Windows\Logo1_.exe
Filesize
26KB

MD5
7e2d4dc228c87c716412c5f88c8ba1bc

SHA1
68a1f791f9c818e50919266b4b8fdacbd342f8a4

SHA256
60da23d6016a27add33a1c2376bb53a25d04ff24679e9fde80ea37e8204abe4a

SHA512
acd4e4ace4c823cf71bcfa44ea4ef8058f9feca480b671cab8e4effd4271e94084c7119a711dbfc9fe7bcb7005e912531c6406141e11748ed3811ac8023d63db

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini
Filesize
9B

MD5
3b22ce0fee2d1aaf2c66dcd142740e29

SHA1
94d542b4bb9854a9419753c38e6ffe747653d91c

SHA256
8284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79

SHA512
efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b

Download Submit
memory/1096-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-1851-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-3311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-91-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1352-30-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2072-16-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download
memory/2072-18-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download
memory/2072-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

pid	process
1096	Logo1_.exe
2492	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads