be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
Size

577KB
MD5

1d5981eb84e918e433f083dd445f3578
SHA1

b3be9cf4be408f589dcff53a0df8ee5f8add3e15
SHA256

be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe
SHA512

de4d52a73053a693087b5d3e225a67bc9d5164df5fd641c54c7782974b63c2693d88e883c47ab07ba790322439aee1cc48339f22016050b6ac1da3c8f985860f
SSDEEP

6144:q46tGdye419E7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4H:q3NbI7a3iwbihym2g7XO3LWUQfh4Co

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
376	Logo1_.exe
4688	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Client\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
File created	C:\Windows\Logo1_.exe	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe
376	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1312	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	83
PID 2004 wrote to memory of 1312	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	83
PID 2004 wrote to memory of 1312	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	83
PID 1312 wrote to memory of 3928	1312	net.exe	85
PID 1312 wrote to memory of 3928	1312	net.exe	85
PID 1312 wrote to memory of 3928	1312	net.exe	85
PID 2004 wrote to memory of 388	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	86
PID 2004 wrote to memory of 388	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	86
PID 2004 wrote to memory of 388	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	86
PID 2004 wrote to memory of 376	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	87
PID 2004 wrote to memory of 376	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	87
PID 2004 wrote to memory of 376	2004	be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe	87
PID 376 wrote to memory of 4696	376	Logo1_.exe	89
PID 376 wrote to memory of 4696	376	Logo1_.exe	89
PID 376 wrote to memory of 4696	376	Logo1_.exe	89
PID 4696 wrote to memory of 1392	4696	net.exe	91
PID 4696 wrote to memory of 1392	4696	net.exe	91
PID 4696 wrote to memory of 1392	4696	net.exe	91
PID 388 wrote to memory of 4688	388	cmd.exe	92
PID 388 wrote to memory of 4688	388	cmd.exe	92
PID 376 wrote to memory of 3064	376	Logo1_.exe	93
PID 376 wrote to memory of 3064	376	Logo1_.exe	93
PID 376 wrote to memory of 3064	376	Logo1_.exe	93
PID 3064 wrote to memory of 5052	3064	net.exe	95
PID 3064 wrote to memory of 5052	3064	net.exe	95
PID 3064 wrote to memory of 5052	3064	net.exe	95
PID 376 wrote to memory of 3552	376	Logo1_.exe	56
PID 376 wrote to memory of 3552	376	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3552
- C:\Users\Admin\AppData\Local\Temp\be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
  "C:\Users\Admin\AppData\Local\Temp\be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E75.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe
      "C:\Users\Admin\AppData\Local\Temp\be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe"
      4⤵
      Executes dropped EXE
      PID:4688
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
251KB

MD5
34e4b1c3fbe0af431dbfa32a394d538b

SHA1
f3244184975b4613fddee62e1df0befe5f1cb023

SHA256
cec6257742a6cb48acd9e0c67e5f3dcf31ae37a5a10b21341e017ddf8dfd6bba

SHA512
744ecda9422db65edef59ec38a98c757e38f058d5673ffa0d7cc4a1434fa402262f18a98884f33649c9bcae8e334d2453f337a49f6c24effce32b19e1b7e6200

Download Submit
C:\Program Files\UnregisterPing.exe

Filesize
388KB

MD5
72ac6d63170c964cf7e11687b02816a2

SHA1
4ac0479125857fd381a4a43c5110c6a7efa529f7

SHA256
4424ac53ad0df0bf1f24e18d56203f503c5aecb99a318b9b87334e256890b38e

SHA512
5ed1314d54073c96a5e35c5edecddcaca44e0e856c0b7cd492e7802993f3f9cfea24100f72865cf7432f2c14113c75d6fc430e11bce28d83c3e95285e60134b5

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
644KB

MD5
85f79b883012dd5dc037b06f462adac7

SHA1
f12851feae4f0bcf48d0d462f45f2decbf94967a

SHA256
b336dfcbf2ef97806dd0f82228a4a803a6bd3ca71c8388dc1da04dff8c359b34

SHA512
e2abde81d4f1c7c8dd590b6a92b5035e7ec86bcd71b5509065a15912b633989baa8f1f610552098a77f1d43b7516e6042b190c446193ce26a2173ca17c6ca2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8E75.bat

Filesize
722B

MD5
25bbc52723309d9db41e9dcb4143cc8c

SHA1
a7aa5077e1324fedbd30167270884f2f70f5deb9

SHA256
89de978e72b3f1befc1ad3c9ccf327e5c45805c87e90fa7dc711a512d9ab80ec

SHA512
5fcabc213cf44733552d20af4fe68d6ef63f9bf54d57736288a285529dee62ea866e43d8ce480c69d33e6857cdcb0e2d93511ad48060c9fc64f1b3cec84b938a

Download Submit
C:\Users\Admin\AppData\Local\Temp\be48fbe9c9ee8053fa2370d7c6edeb47e074bdf61686f2e208f9c3f6b7299ebe.exe.exe

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
6c2e4d9285e03d13ad3438424d7c0433

SHA1
199aa50fc7e1e2cd42d28599027a07bc33c77012

SHA256
ed075c4bc2193c36e740c272f806413273c0cd7ecfa182cf31d9f8e0a2e37cc6

SHA512
e44c0dc38f8d8af74b121b1b70e7ed883e186178898e07af391858dd38340ad5915f8f079679073c8b1d60900d387764f38557e8bc1d02752fde02c596f4704c

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
842B

MD5
6f4adf207ef402d9ef40c6aa52ffd245

SHA1
4b05b495619c643f02e278dede8f5b1392555a57

SHA256
d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

SHA512
a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\_desktop.ini

Filesize
9B

MD5
5412111268dd2c1fb1cf8697bfab9b6c

SHA1
16d0b289e83c74cb50a004edd7c5750ac706f321

SHA256
f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc

SHA512
13fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf

Download Submit
memory/376-19-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/376-3220-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/376-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/376-8704-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2004-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2004-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download