Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 13:20

General

  • Target

    c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe

  • Size

    397KB

  • MD5

    d949734f20f79ec417d3e7fb6449d02e

  • SHA1

    e14a4a9a431a9be9108e85e0c25b0a271e806a97

  • SHA256

    c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb

  • SHA512

    bcd836a9b8e4fadc1c4078e23028fb19bba49e0afec2f63f8054565a14fb917dfa22e6d2b07eea906ec1381f1831411c76157fec934f9d591031b19382c2bb05

  • SSDEEP

    6144:x+arnDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:x+arDXYJmSTZwYp32bY4qtDF

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe
        "C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2952
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2F4A.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe
            "C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe"
            4⤵
            • Executes dropped EXE
            PID:2600
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2524
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2564
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2688
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1976

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            0494cb58fdd2834f0bb643fed134c06d

            SHA1

            267067f4b556fe8d0f6d710507962ad0336a21ea

            SHA256

            96845bf1b4e6d82d868c785c094a83cc82f1b6ecf3373d8d63c4109048dcb7ab

            SHA512

            311e4a299e2d74e964f460ca5841f716bfa3dc6ba4f13f3801c7f6b1e6a5f6941c1a35f2754544c769bccf27c68d24585a17463eb1cf9eea22337af867a9f4dc

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            477KB

            MD5

            c32f3ae2a93a21a604cd493d86b40278

            SHA1

            4428387f1a1dd12ff5607459bcf4d89cd8ed80fe

            SHA256

            b84bbbbc007c88ca79ea94b2cf92e7a3093c8de3a8ce4b70b6f4d0a9480595a8

            SHA512

            5e7bb3318deebf7663fc4b9c3b20ce75986e32cbb27c34ec94fccf5affde4f0dd9e5dd0bef38510d088ec00b885dccafff09706a75fd927f882540ead7cc7965

          • C:\Users\Admin\AppData\Local\Temp\$$a2F4A.bat

            Filesize

            722B

            MD5

            f48b473b255ab2ec30775a57592141d2

            SHA1

            e2e2118d7164dac2ce1385a27e750240981d925e

            SHA256

            1d56018bd4903103b6638161d4d8a6885fe55fddc70cde541d106cc7ef97534e

            SHA512

            f42f39116888b92aae77197282aa6a660f8fc7a72850b635b6c8c88fb62eddbcda2a36a86d6e1c0491ae64d8dbbbd2106cd64a756d7670f59c935774af36f22e

          • C:\Users\Admin\AppData\Local\Temp\c614605e127fabad1d114b2fb3da573bce409aa322e885f11b6793402da700fb.exe.exe

            Filesize

            364KB

            MD5

            213eeb5e8f54231f68e5b26a0fc81bd1

            SHA1

            1bc31a42536eacbb57d1cd92ec4b5524a82264d2

            SHA256

            b309045509efc205eb35d6037d64640093fde6c54ec5934e329b447417005a50

            SHA512

            ce35c5f453126c98329df141f821c55692f9252549c76921c231d8170df356cda1689e636758519c0b6898f11b5c836cdb4967d296b99f915e4d1980470a083b

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            39e2aebdacc63ecaceef4394c1e9829d

            SHA1

            edb6f5b8af0ed1c5c8f3004a4ef88cbf71f110ed

            SHA256

            39c54788ecedf35129aecaf6018ec37859880f7aec519fda671543d2107cc3ff

            SHA512

            322835c38adb97931efc65e013908ebada73efa8a33d45f320fc5c5b80376ac8327b0eecfddce35fc82d1ef2afaa57604f31cd48ebdeb866a87f09c51b7808e6

          • F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\_desktop.ini

            Filesize

            9B

            MD5

            5412111268dd2c1fb1cf8697bfab9b6c

            SHA1

            16d0b289e83c74cb50a004edd7c5750ac706f321

            SHA256

            f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc

            SHA512

            13fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf

          • memory/1244-28-0x00000000025D0000-0x00000000025D1000-memory.dmp

            Filesize

            4KB

          • memory/2164-31-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2164-3001-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2164-19-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2164-4190-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2708-16-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2708-0-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2708-17-0x0000000000270000-0x00000000002AF000-memory.dmp

            Filesize

            252KB