Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe
-
Size
186KB
-
MD5
be4302b59375d53a7785b9a57e20aa96
-
SHA1
4b1969e92a87c6895363610deb55ed25490d2ceb
-
SHA256
84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0
-
SHA512
1060a5acb1e41369c361b4d4809f9304467511b9a11c3d457d72dd3bf661e08458f3128033817ceefd0b94ae2ab13cc7dbfa524728bbc17d0304d6dac20b9471
-
SSDEEP
3072:2i8aNARYLJXJoYtpA/H3RpDecC+EZX70RjLTu46R0Eb:gSgYLjvqXRpDecw7Kj3u46db
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4804 Logo1_.exe 4620 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Temp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe File created C:\Windows\Logo1_.exe 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe 4804 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1288 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 84 PID 1044 wrote to memory of 1288 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 84 PID 1044 wrote to memory of 1288 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 84 PID 1288 wrote to memory of 3960 1288 net.exe 86 PID 1288 wrote to memory of 3960 1288 net.exe 86 PID 1288 wrote to memory of 3960 1288 net.exe 86 PID 1044 wrote to memory of 4364 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 89 PID 1044 wrote to memory of 4364 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 89 PID 1044 wrote to memory of 4364 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 89 PID 1044 wrote to memory of 4804 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 91 PID 1044 wrote to memory of 4804 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 91 PID 1044 wrote to memory of 4804 1044 84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe 91 PID 4804 wrote to memory of 860 4804 Logo1_.exe 92 PID 4804 wrote to memory of 860 4804 Logo1_.exe 92 PID 4804 wrote to memory of 860 4804 Logo1_.exe 92 PID 860 wrote to memory of 3500 860 net.exe 94 PID 860 wrote to memory of 3500 860 net.exe 94 PID 860 wrote to memory of 3500 860 net.exe 94 PID 4364 wrote to memory of 4620 4364 cmd.exe 96 PID 4364 wrote to memory of 4620 4364 cmd.exe 96 PID 4804 wrote to memory of 3704 4804 Logo1_.exe 97 PID 4804 wrote to memory of 3704 4804 Logo1_.exe 97 PID 4804 wrote to memory of 3704 4804 Logo1_.exe 97 PID 3704 wrote to memory of 3340 3704 net.exe 99 PID 3704 wrote to memory of 3340 3704 net.exe 99 PID 3704 wrote to memory of 3340 3704 net.exe 99 PID 4804 wrote to memory of 3480 4804 Logo1_.exe 56 PID 4804 wrote to memory of 3480 4804 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe"C:\Users\Admin\AppData\Local\Temp\84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B9.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe"C:\Users\Admin\AppData\Local\Temp\84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe"4⤵
- Executes dropped EXE
PID:4620
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3500
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3340
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5b2d42d2acc3ae6aeae98d929b3fceffd
SHA19a56b274f4e073f8e9f5869fad424ed8953d841c
SHA2566813174f48fd25892a5fa28d0dd808df9ff007f751539d5f6f99e30cda0d96b5
SHA51257feee21c0493c7fda61517d7bb734596e0de791bbdf09fe85ccc43e532f1fe65a4a4514ce9de20a1394e9f238444e14568ffbcc8fcc434f88b5a7d956c39ea8
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD59044b8cb7dee805474f46fdff328cebb
SHA11cabc4c6c2c86cbb78765bc9dbc34fb343a473d2
SHA25662fedddac5d2bc0012582f6d5c8a62f1cfeb146338ded33892f3e2e9a3080618
SHA5124c3baf797abb9745bd194cb39da4f7541273d5ceb694929e562b3823118a8851a9b5dde4379d3936ca8fc233339560f7716518a62b421a2fcfe228d1037d9753
-
Filesize
722B
MD51721e4be96e8c6ac821cd0bb1865c1ca
SHA18f97c3e8f2f747dbd7589acd9bdbb3686ce0a4ab
SHA25693c6b9824073784ccb444fbe24d1f5e42a07692c2359219f1488976af765bb2d
SHA512b53c5c777f4259a677068b39545835276e9fcee0ff763ec6dea14d74db0ebc98033e5a94dbfa1c4c5ef814674c19a418738e7d745967e4c37e12f29d5b18c86f
-
C:\Users\Admin\AppData\Local\Temp\84f849fd424cf421a3a23c37bab1f4af27d78ee6439c392f05f9bc8430477ee0.exe.exe
Filesize152KB
MD53440c72d695db245adb2728b6a5d9b1d
SHA11e510973687c9a0b58464aaf43048a183d825e26
SHA25637462e31a348d32c9421557f38a601a632c0bdf24d8157481ba82b45f8fef64f
SHA5125be93dca3a1f9b8e286146d43f848ef6b8bc5ef99ca5cf50839a62dd5083d915dc94ca5a30658838e2365a45a5dd522e641ee71f811202148c9db860113018e6
-
Filesize
33KB
MD5356cac02b916fa68cdb143461cd998e9
SHA1888516965d3843e0a10864d6cc0480cc912cf0a8
SHA256c0e06a40330d72717d8c82fa7844df30dd8c6d99447e2e2372dc22a95120a92f
SHA5126daeea1394153fb814655ef67b6220182f8eb0fb995f189f455771412e484c6522a6965c13b6ff748060778b25397ecb8a627b2fea4dffcf526ade0aaec53965
-
Filesize
9B
MD5e2a14c19421b289cbd51a76363b166bd
SHA15d0621d68da5a444f49c090b0725c7044d47fdb7
SHA256844af243be560dc4e478aa7ea28f4959f9df45f204006bade7ae52398d651835
SHA5128c49bec05605c4d2b8f07f00a7a39e70f5bd4f7c84ba221c615447f947053bf3bb0496c38e2bf8b15235c493cc5a0b41f34285fed1adb4c13572f25b67e178e5