Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 00:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe
-
Size
101KB
-
MD5
7ad6e95ed44ec9b92db8ea11d53a62e2
-
SHA1
d321ff9146b53b05a1a6be41f4f565f32f6a9168
-
SHA256
936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9
-
SHA512
bd7b6fe8741e979250f83d139df95382cbefa0a9b0c4a3a9a43aa0ea20afb24fa9089392e6add6658278ad936f667b261f46da2d116d291d2f250eddae010bc2
-
SSDEEP
1536:2Rpsrz8GvnGYWtwXaa8NPI9j+RedcP01ic4Brg:2i8aTWtwXwKRj1EBrg
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3768 Logo1_.exe 4172 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe File created C:\Windows\Logo1_.exe 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe 3768 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5100 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 83 PID 4820 wrote to memory of 5100 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 83 PID 4820 wrote to memory of 5100 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 83 PID 5100 wrote to memory of 4776 5100 net.exe 85 PID 5100 wrote to memory of 4776 5100 net.exe 85 PID 5100 wrote to memory of 4776 5100 net.exe 85 PID 4820 wrote to memory of 1192 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 89 PID 4820 wrote to memory of 1192 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 89 PID 4820 wrote to memory of 1192 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 89 PID 4820 wrote to memory of 3768 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 90 PID 4820 wrote to memory of 3768 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 90 PID 4820 wrote to memory of 3768 4820 936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe 90 PID 3768 wrote to memory of 3044 3768 Logo1_.exe 92 PID 3768 wrote to memory of 3044 3768 Logo1_.exe 92 PID 3768 wrote to memory of 3044 3768 Logo1_.exe 92 PID 3044 wrote to memory of 1712 3044 net.exe 94 PID 3044 wrote to memory of 1712 3044 net.exe 94 PID 3044 wrote to memory of 1712 3044 net.exe 94 PID 1192 wrote to memory of 4172 1192 cmd.exe 95 PID 1192 wrote to memory of 4172 1192 cmd.exe 95 PID 1192 wrote to memory of 4172 1192 cmd.exe 95 PID 3768 wrote to memory of 1128 3768 Logo1_.exe 97 PID 3768 wrote to memory of 1128 3768 Logo1_.exe 97 PID 3768 wrote to memory of 1128 3768 Logo1_.exe 97 PID 1128 wrote to memory of 636 1128 net.exe 99 PID 1128 wrote to memory of 636 1128 net.exe 99 PID 1128 wrote to memory of 636 1128 net.exe 99 PID 3768 wrote to memory of 3436 3768 Logo1_.exe 56 PID 3768 wrote to memory of 3436 3768 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe"C:\Users\Admin\AppData\Local\Temp\936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8676.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe"C:\Users\Admin\AppData\Local\Temp\936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe"4⤵
- Executes dropped EXE
PID:4172
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1712
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:636
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5b2d42d2acc3ae6aeae98d929b3fceffd
SHA19a56b274f4e073f8e9f5869fad424ed8953d841c
SHA2566813174f48fd25892a5fa28d0dd808df9ff007f751539d5f6f99e30cda0d96b5
SHA51257feee21c0493c7fda61517d7bb734596e0de791bbdf09fe85ccc43e532f1fe65a4a4514ce9de20a1394e9f238444e14568ffbcc8fcc434f88b5a7d956c39ea8
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD59044b8cb7dee805474f46fdff328cebb
SHA11cabc4c6c2c86cbb78765bc9dbc34fb343a473d2
SHA25662fedddac5d2bc0012582f6d5c8a62f1cfeb146338ded33892f3e2e9a3080618
SHA5124c3baf797abb9745bd194cb39da4f7541273d5ceb694929e562b3823118a8851a9b5dde4379d3936ca8fc233339560f7716518a62b421a2fcfe228d1037d9753
-
Filesize
722B
MD5c38fe22ed9af89c370da297eae121dcf
SHA13a801971a567548d3204ddd94e52b8756e35aca5
SHA256c989b8b39bb06b6b5a2d652a49a0b3ed842fc3883bcf346d5e7c0154d7343c84
SHA512eb3f51441bdcf8fc7d4e78b7cabf055adbf0655b15fceff69a19dba54dea4a3713973f6b63ac01115fb007e9df49995303ed8e91f15685e1065aefc2df6b6c2e
-
C:\Users\Admin\AppData\Local\Temp\936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9.exe.exe
Filesize68KB
MD548335cfbe6a9bdaa2492ca1320b70a3a
SHA16d3c3d659e3718a0b56f52c9d4386d55d7672b97
SHA2564ec34f1d893e8cc02f669fb5eb329bbcc5374bd7e7284e8fd86fbc29d2ffeb4d
SHA5129eaf3b380449ab1d2b4b6371336fc71f6a43eee0295de012d0859e7f3b80a87f9d8316b0e65d4ca450630ee17b95c64e79e594bfe27fb3965917b0c5bc2d1b58
-
Filesize
33KB
MD5356cac02b916fa68cdb143461cd998e9
SHA1888516965d3843e0a10864d6cc0480cc912cf0a8
SHA256c0e06a40330d72717d8c82fa7844df30dd8c6d99447e2e2372dc22a95120a92f
SHA5126daeea1394153fb814655ef67b6220182f8eb0fb995f189f455771412e484c6522a6965c13b6ff748060778b25397ecb8a627b2fea4dffcf526ade0aaec53965
-
Filesize
9B
MD5e2a14c19421b289cbd51a76363b166bd
SHA15d0621d68da5a444f49c090b0725c7044d47fdb7
SHA256844af243be560dc4e478aa7ea28f4959f9df45f204006bade7ae52398d651835
SHA5128c49bec05605c4d2b8f07f00a7a39e70f5bd4f7c84ba221c615447f947053bf3bb0496c38e2bf8b15235c493cc5a0b41f34285fed1adb4c13572f25b67e178e5