Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-09-2024 06:24

General

  • Target

    cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b.exe

  • Size

    66KB

  • MD5

    797f7039cca8baf1b26483e056bd0c3a

  • SHA1

    4a269463373d97a42605c2371235473f3bcc1192

  • SHA256

    cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b

  • SHA512

    03e51ecea0b53539d761552907394f0988a00e44e9a9ed9bf54cc31ea8a53fc185eeb5802a9d5fdf211c430f22b3aef28c3cac11493923c29195be58342ef1f4

  • SSDEEP

    1536:/BqQesrz8VuJlMXaDuiNz/MF0Vz5gpEaDoc:/Bqi8ulMXaKM/W0VzBaDP

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b.exe
        "C:\Users\Admin\AppData\Local\Temp\cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2348
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2488
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aDBFD.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Users\Admin\AppData\Local\Temp\cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b.exe
            "C:\Users\Admin\AppData\Local\Temp\cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b.exe"
            4⤵
            • Executes dropped EXE
            PID:2812
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:596
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2824
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2272
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2580

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

      Filesize

      258KB

      MD5

      f3daa33c4f426df8cbae44f4a090be92

      SHA1

      c65dea97b5249dabffbb5cf61257a8fb8c71406f

      SHA256

      83553239bce617ddc905d0c045f4fe01643e10ab575d0a70ef67a88ffe849406

      SHA512

      f6410ad9cd28c9977eccb32adad64eac7c0b506b25747721b68f758c3ee9ae12705e36dadea44f2d0a6a1aa875be2b12b3b1172e4d0ea6c735e80775a0f631dd

    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

      Filesize

      478KB

      MD5

      fa1ca34b203e8244b1102d8ad38035c2

      SHA1

      d3ec13ced225363368a77396e000538a66d0fd37

      SHA256

      a48bfd2e24c826fbabe3adbc037da84fb2ab5dc4942ed22ca31fad3ef8e657cb

      SHA512

      68943886e5f7c6f7f0b52a6b10232dc3a12db86a3246e12a0da9c827ca0ee115d35e1182b56ef8a9c824e01daa1c5e147bc349ab8e41703a9807e93926b7a165

    • C:\Users\Admin\AppData\Local\Temp\$$aDBFD.bat

      Filesize

      722B

      MD5

      0d31a00028b65bf60e5fd81016123934

      SHA1

      3d43fd03e31510ab81a39c82eb86159c2d916bda

      SHA256

      76eda1302e22232aa9a3b7eeeba2516e11e27406f2e81604a45392132fa7b666

      SHA512

      082b02020ad6ecb72bb930278d509c7aa12439246d1efaf161268c6882cb52efcfed0df19a676610f9fc2b372fdc31678b4acdf820f8b54531148a7ac98e3dee

    • C:\Users\Admin\AppData\Local\Temp\cedb4bf4c023b933d8615c09df09f266bf843fdeea46b9881f4473b0bce1a38b.exe.exe

      Filesize

      33KB

      MD5

      cfcf15f5729649399cfb9b2590c9e80a

      SHA1

      f595a3f2812a29492326e5a0478f3924bcbae545

      SHA256

      b6fde5431374f5cc8a2b6b6953d7c466ce8828faf68c43661a2c0cf87481868f

      SHA512

      bbd925abf352af8962ab5e7d4b76bc4146e806cb0f8fde8a7cc2c13318450b46dd5529f6855065241de56efd72e33f4f9961ef5aa4ba8fd3c1ca312444ac8e19

    • C:\Windows\Logo1_.exe

      Filesize

      33KB

      MD5

      63f3782c5c4e2474a184e3891df996ad

      SHA1

      727fa46bfd850377a4e53d9440aca6d573ad62a9

      SHA256

      025c4d9b205d7003c44303a47e8bdb7f4b2a50ff1e02d7d28be74f5371059e92

      SHA512

      ec501796a81c1f1f059e9e3f7882f184a9cf01af622f573f55c6ef4c1b3318a818aa93ebc8ecf358a948c39028957360588909255636ae296b6602bd8ba92329

    • F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\_desktop.ini

      Filesize

      8B

      MD5

      4b4a61d6d446a36ccde31e7ebd6e7aeb

      SHA1

      6abcca1983b34a570385eb5b421b92449c851dfc

      SHA256

      d685543d9800644339454e98bc6c2f9ccea646fd51fdb5181583ca60fcdef8e9

      SHA512

      c25ac03153db7beb8b163c82e5ef75e916346047a00202825b79797b6259f877eea6fac6ea333743d7e423d5fc65d713e9e0cafc0631321beab8ae01ede9ee65

    • memory/388-17-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/388-0-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/388-18-0x00000000002C0000-0x0000000000300000-memory.dmp

      Filesize

      256KB

    • memory/388-16-0x00000000002C0000-0x0000000000300000-memory.dmp

      Filesize

      256KB

    • memory/1192-29-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

      Filesize

      4KB

    • memory/2280-33-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/2280-20-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/2280-2438-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/2280-4155-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB