Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe
Resource
win10v2004-20240611-en
General
-
Target
49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe
-
Size
573KB
-
MD5
70c4e6e39f45b3c462a19493e22a89e6
-
SHA1
a1b00301c3deedabdb6a835d9cf3660aaf8502af
-
SHA256
49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d
-
SHA512
4d192c0e8a63addfc044f923d34c12704ec2ec9cedbf6489838bd5a0960c4f38ff89560f684aeae5a4666d0b19f271d4f830a5a482d9a80a58de3a49d7a9a4eb
-
SSDEEP
6144:YuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:M7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2340 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2648 Logo1_.exe 2816 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe -
Loads dropped DLL 1 IoCs
pid Process 2340 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VGX\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Portable Devices\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Uninstall Information\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe File created C:\Windows\Logo1_.exe 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe 2648 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2340 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 28 PID 2372 wrote to memory of 2340 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 28 PID 2372 wrote to memory of 2340 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 28 PID 2372 wrote to memory of 2340 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 28 PID 2372 wrote to memory of 2648 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 29 PID 2372 wrote to memory of 2648 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 29 PID 2372 wrote to memory of 2648 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 29 PID 2372 wrote to memory of 2648 2372 49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe 29 PID 2340 wrote to memory of 2816 2340 cmd.exe 32 PID 2340 wrote to memory of 2816 2340 cmd.exe 32 PID 2340 wrote to memory of 2816 2340 cmd.exe 32 PID 2340 wrote to memory of 2816 2340 cmd.exe 32 PID 2648 wrote to memory of 2800 2648 Logo1_.exe 31 PID 2648 wrote to memory of 2800 2648 Logo1_.exe 31 PID 2648 wrote to memory of 2800 2648 Logo1_.exe 31 PID 2648 wrote to memory of 2800 2648 Logo1_.exe 31 PID 2800 wrote to memory of 2680 2800 net.exe 34 PID 2800 wrote to memory of 2680 2800 net.exe 34 PID 2800 wrote to memory of 2680 2800 net.exe 34 PID 2800 wrote to memory of 2680 2800 net.exe 34 PID 2648 wrote to memory of 1200 2648 Logo1_.exe 21 PID 2648 wrote to memory of 1200 2648 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe"C:\Users\Admin\AppData\Local\Temp\49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aDE6.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe"C:\Users\Admin\AppData\Local\Temp\49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe"4⤵
- Executes dropped EXE
PID:2816
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2680
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD548b536408ac1a66263ed8da4ec21add8
SHA162d20d73d6035d5ce1e1bf1068ff3bf52d609c3b
SHA256fbc2cf414606174f3555d76fe647557b72ac47e6bda0864fd8c5dad738df1733
SHA51244f09df70cb4cafa63f88899b0b0fa07bf8fcd5d0106a9a945453de7570c37985039c4a7267708815b6c707539e9a4472d329f010f6a692c5c1fcaab6c41f1c0
-
Filesize
474KB
MD5de4228cb7a5a7f082477f6a504b822a7
SHA1dfd84f0b6f4977bfda43b1827aa747a9a5a8a38b
SHA2568c5089a062734aa1a66e70700d4f33f2f54157c4bb3ed4d6ce1a852de8b6f90b
SHA512a3b64b10a22dedebfa48e7705e148d50df480fa9bb0669bc06951ab0ff5f97657f72dc8b71db610499ee38ecae9ae494265841a737806bed7c061d0b634913c8
-
Filesize
721B
MD57e6f40a709010033858a0e9593662a91
SHA1ce71bdd1acacad3751553ee5311af6bad911ca6e
SHA256e856bc6aeb6bd37323a18a5393fef61300ffd854ff79bb9ad41c955688d7127c
SHA512004ef201f889bfeea67dd3ae64301f95b4a5d20cd47647c7920e75eaa4a743de4bf3d7b043441ecb67ebd41d5a61e04cb06f52b59b6ca55e2cd8fc052ff635bd
-
C:\Users\Admin\AppData\Local\Temp\49d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
29KB
MD59fcfb6b631b5a62c2af6f852de61dc71
SHA102149b5ae9d7c72cc2df500a9cf25ef4234614e1
SHA256470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a
SHA51269076244e4c53b09a9d3595e6b53201013ce006da986542f8375223640e5ce66d000c9f02c71d3856ea0f3f788c139fce670ae26c571bd71d801bd67e15cb66a
-
Filesize
9B
MD51f206a052c160fd77308863abd810887
SHA13b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1
SHA25645129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1
SHA512bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5