50d55e07cfe3857fb23be1d76c3389054a3a8a723f43380505241622eba3a3d0

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe
Size

73KB
MD5

4008bc6c58a09d901019afb2d70d6af1
SHA1

25e5596bc9499893e30b61c957d56c52109bfc1a
SHA256

c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b
SHA512

2e9af1140d082dd0b4cbd0c071bb40755224523b92ae4dedd329808081262aab6d69b7e907370c56eaff1a9abf52c588ffea5984619747ba3b722b1d020d7311
SSDEEP

1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitDuK8wFxHK6FrHUM/g:qKtfDwsjPThTYszDH2fPxH/FoZ

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2224	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2748	Logo1_.exe
2764	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe

Loads dropped DLL 1 IoCs

pid	Process
2224	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\misc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{C10A79F8-2372-49E3-801D-73DDEB38AD5B}\chrome_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\sidebar.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	Logo1_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe
File created	C:\Windows\virDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2224	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	30
PID 2932 wrote to memory of 2224	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	30
PID 2932 wrote to memory of 2224	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	30
PID 2932 wrote to memory of 2224	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	30
PID 2932 wrote to memory of 2748	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	32
PID 2932 wrote to memory of 2748	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	32
PID 2932 wrote to memory of 2748	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	32
PID 2932 wrote to memory of 2748	2932	c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe	32
PID 2748 wrote to memory of 1232	2748	Logo1_.exe	21
PID 2748 wrote to memory of 1232	2748	Logo1_.exe	21
PID 2224 wrote to memory of 2764	2224	cmd.exe	33
PID 2224 wrote to memory of 2764	2224	cmd.exe	33
PID 2224 wrote to memory of 2764	2224	cmd.exe	33
PID 2224 wrote to memory of 2764	2224	cmd.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe
  "C:\Users\Admin\AppData\Local\Temp\c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a7A1F.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe
      "C:\Users\Admin\AppData\Local\Temp\c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe"
      4⤵
      Executes dropped EXE
      PID:2764
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a7A1F.bat

Filesize
722B

MD5
a39942e442b0656712ef004c5eebf9f5

SHA1
5b5c47e50da05a3e28ddeeab3c1f675d54845771

SHA256
96f36704a64625ba9c26041ead320fd87f7de70d1d4ad3742b5b363b8125c419

SHA512
1a674bc5fc827e8f0e10c38220bbe4f4775bce61a53f4650ca1f86861f1824c047b63b5dde00fd6efae7ab62be17d62df7df6e59296b09fd68bf3eb139b13bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b.exe.exe

Filesize
15KB

MD5
aa6de3b84d95ce3559202a9dc56d48a6

SHA1
b6dd9ee8468889bc72eab148edea64e49237b955

SHA256
55ed3a9b580cbbf36dcad57160054a4952d4af2aae6230c81f6a9a1e2450e211

SHA512
27946a8652d69ff50301a93a678b2ce15ea63cefe54c8f0f192b37f5c9d3ee5f1d34864f045b0a79464d31d864910c281c0be11bafa917162793b0dde1e12239

Download Submit
C:\Windows\Logo1_.exe

Filesize
58KB

MD5
5b9d1ea57e40c0636fe1c1fbcbd5a368

SHA1
c5573447bcb3ed3fa0dff406f03cb9842b062419

SHA256
15a6900fe8e23897487abfde1aecdacf532f1ce9019ce106abf2c81362121be0

SHA512
f123c53ac52f2b50b4b2d573d57cc80ef7c98ba867bfed68e3987d03ee6d2912eff58bee43f1e502e393148b63485b782a064f877d2c7896cf09180e670d0c87

Download Submit
memory/1232-19-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/2748-239-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2932-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download