Analysis

  • max time kernel
    150s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 19:07

General

  • Target

    74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6.exe

  • Size

    70KB

  • MD5

    b3a19fea9b09a1ed3717d61c993b696c

  • SHA1

    375ae215ac9b5141116bf16e6fe254dfbcfdc686

  • SHA256

    74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6

  • SHA512

    1c2df4ab21c09a943a87bfeba1d4c7287052aa59640281de7a5bc246e1542d72f118fed05d7398c2e0b0a81d345774b1e2d5914e56925421f106ca144f49fba7

  • SSDEEP

    1536:PHHzaYzMXqtGNttyUn01Q78a4Rwriw+d9bHrkT5gUHz7FxtJ:PHTaY46tGNttyJQ7KRwrBkfkT5xHzD

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1372
      • C:\Users\Admin\AppData\Local\Temp\74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6.exe
        "C:\Users\Admin\AppData\Local\Temp\74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2336
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a891D.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Users\Admin\AppData\Local\Temp\74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6.exe
            "C:\Users\Admin\AppData\Local\Temp\74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6.exe"
            4⤵
            • Executes dropped EXE
            PID:2728
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops file in Drivers directory
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3064
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2752
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2712

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

      Filesize

      258KB

      MD5

      78027959d5cff1141c07380e803faafe

      SHA1

      122c33e1e6909c587b9968892a430145a6e1d031

      SHA256

      768341063dd8754f8cdc5d8b85c3b81c556810b0f94335e9bc73eeda39466b9e

      SHA512

      1683d3ac13a3678f71fb153045d64203f81d3833f8dff13057bc163d4f04b619ee285c2922e02e9d762339d29ee8cfa0355c6cb06cbd4fab0c106a630d9a66bb

    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

      Filesize

      478KB

      MD5

      0165e17c5e9a80f5533940114281c930

      SHA1

      5e5bd89c8cb9e5ec512e5759c5b1e080ce27c9a6

      SHA256

      f8ea49a11b2001dda551b78c743cfc62461d8270aab8ed822a5dfb68c3a269a5

      SHA512

      56f43711fd84c5052e1d15fe47fd7755b0aa944197e08c6a84762c2db6dc2ea1fbe2b14451772f213f82a34e18d4a79b7c3efd5be211b86ecd7c9603fd4c772b

    • C:\Users\Admin\AppData\Local\Temp\$$a891D.bat

      Filesize

      722B

      MD5

      4d5d929d3bcad72c9bed5b172d8650fc

      SHA1

      aba643e14334cd77e58b42a53ac4581ed3b64f3b

      SHA256

      0d9586ac2baa5a77af936af9eecbd6c5fedc086ab8aa7e696c6d227689bfd6d0

      SHA512

      0a8d0ab5bd1516875d537251c063b9d539c15f8be1fb8288881478da056f66e08b0a9f43206d43ae38fed37733f5aa75318f3c45770fabe72731701ca9a9ba44

    • C:\Users\Admin\AppData\Local\Temp\74efd16fdb4efeeed9634e473de4bd83fc3807c8d5abf431a64f43319fbb69a6.exe.exe

      Filesize

      36KB

      MD5

      9f498971cbe636662f3d210747d619e1

      SHA1

      44b8e2732fa1e2f204fc70eaa1cb406616250085

      SHA256

      8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41

      SHA512

      b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93

    • C:\Windows\Logo1_.exe

      Filesize

      33KB

      MD5

      40273888e6f810c5d36b67a557705a9b

      SHA1

      c3645a700012862685fe72fd7b48111e99096328

      SHA256

      37ac64227c05364e74a0d788824758e8783e4d57ec9fb38db311e40111b1403a

      SHA512

      695354d1339276071024a89279ee97e3b519fee92e7a89aef3333cafe00ea4537f4e7e1f22ae9804719ac47d5fa867413681290916e832864a430c463e10e658

    • C:\Windows\system32\drivers\etc\hosts

      Filesize

      832B

      MD5

      7e3a0edd0c6cd8316f4b6c159d5167a1

      SHA1

      753428b4736ffb2c9e3eb50f89255b212768c55a

      SHA256

      1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

      SHA512

      9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

    • F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\_desktop.ini

      Filesize

      9B

      MD5

      f74f4ac317419affe59fa4d389dd7e7c

      SHA1

      010f494382d5a64298702fe3732c9b96f438c653

      SHA256

      74fafb0f14fb17a8a4963d5f46fc50b3517e7aa13414ac5f42edfdf212a9bb01

      SHA512

      f82fea1632b97d2b6771f43a6941c84d7fbb86f4c4f69e9b4335aa0e166e2670f09d451da61b13cb16994b9294e99b1cfa27f2447579645b3886b7bd014cc00f

    • memory/584-18-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/584-0-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/584-13-0x0000000000440000-0x000000000047E000-memory.dmp

      Filesize

      248KB

    • memory/1372-30-0x0000000002700000-0x0000000002701000-memory.dmp

      Filesize

      4KB

    • memory/2968-34-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/2968-1823-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/2968-20-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/2968-5726-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB

    • memory/2968-9285-0x0000000000400000-0x000000000043E000-memory.dmp

      Filesize

      248KB