b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
Size 93KB
Sample240921-rt2x3sxcpl
SHA256 b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454
MD5 25a4cfcb77a9f07052292cddc2b48bfb
SHA1 8bbad1c6e7c53c0c6cac3ab3ed83b85d0cfd8479
SHA512 37f257cb5f2575389d44cebef2c1e97503c362338238e9047b697b4e202046a7f86c5724c3d16c228e1de3a8e3d8357d9a795a4f608778519615930129bcb7a8
SSDEEP 1536:2HvaYzMXqtGNttyeiZnZLYm1nHB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:2HvaY46tGNttyeQLYm1nhAWJGSCTBf1u
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
4716	Logo1_.exe
1972	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
File created	C:\Windows\Logo1_.exe	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe
4716	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2008	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	83
PID 1404 wrote to memory of 2008	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	83
PID 1404 wrote to memory of 2008	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	83
PID 2008 wrote to memory of 5056	2008	net.exe	85
PID 2008 wrote to memory of 5056	2008	net.exe	85
PID 2008 wrote to memory of 5056	2008	net.exe	85
PID 1404 wrote to memory of 3984	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	86
PID 1404 wrote to memory of 3984	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	86
PID 1404 wrote to memory of 3984	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	86
PID 1404 wrote to memory of 4716	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	88
PID 1404 wrote to memory of 4716	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	88
PID 1404 wrote to memory of 4716	1404	b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe	88
PID 4716 wrote to memory of 4988	4716	Logo1_.exe	89
PID 4716 wrote to memory of 4988	4716	Logo1_.exe	89
PID 4716 wrote to memory of 4988	4716	Logo1_.exe	89
PID 4988 wrote to memory of 1952	4988	net.exe	91
PID 4988 wrote to memory of 1952	4988	net.exe	91
PID 4988 wrote to memory of 1952	4988	net.exe	91
PID 3984 wrote to memory of 1972	3984	cmd.exe	92
PID 3984 wrote to memory of 1972	3984	cmd.exe	92
PID 3984 wrote to memory of 1972	3984	cmd.exe	92
PID 4716 wrote to memory of 5076	4716	Logo1_.exe	93
PID 4716 wrote to memory of 5076	4716	Logo1_.exe	93
PID 4716 wrote to memory of 5076	4716	Logo1_.exe	93
PID 5076 wrote to memory of 928	5076	net.exe	95
PID 5076 wrote to memory of 928	5076	net.exe	95
PID 5076 wrote to memory of 928	5076	net.exe	95
PID 4716 wrote to memory of 3552	4716	Logo1_.exe	56
PID 4716 wrote to memory of 3552	4716	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3552
- C:\Users\Admin\AppData\Local\Temp\b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
  "C:\Users\Admin\AppData\Local\Temp\b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F11.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe
      "C:\Users\Admin\AppData\Local\Temp\b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
Size 251KB
SHA256 5591244c79a8e0e04bbc4e36e6bf4a55ec59b3d3f4b20d027a668c7f60125dcb
MD5 ad49cc293adc3202b706d4f7127d628d
SHA1 4660eed68d5c97632885a8bd75890aca547cbee0
SHA512 bf1923dfbcb6657d1c6a2a7d7043f51232ae7e148f02f15bc99f458b60c8a3080a1882c8232f598b259b953f8a8ef019d0fc9268af802e42de216645cd3ad1b0
SSDEEP 6144:6B46tGdye41aqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:6B3Nb1ml5a6EdkQgUmR7G9QK3wJx+qS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnregisterPing.exe

Path C:\Program Files\UnregisterPing.exe
Size 388KB
SHA256 10cffec22eff6207eb45e11acf4ea47052c77fa6e7832f237ce572647d9df134
MD5 e8d26e13a1b04d9762f8b4d44c4771f5
SHA1 aa4a82f98709e9324ef62f288ce5e26e06bcb454
SHA512 4fa1647a77ee1a4314927723204141b2cab5a7c5437feeb4362d6b491c634422a92557654a2673060e0cc01924ec6e20f1de29b8677a29b7a3c1a356b3d21686
SSDEEP 12288:uB3Nbho/g0Aozcg9oChYNuplfPo4NtE200drif:i3NVo/NdzNYu1NZ0mk
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-8.0.2-win-x64.exe

Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Size 644KB
SHA256 e33cff13b2b5307aaa06fc8f6d15ebe31eeb5ac6ad8d12b4b5c877eb34cca70c
MD5 74f614352141ac4f78c3e59955ed2258
SHA1 179465d798ce029d20b16601530037ca9d87563f
SHA512 af736346b2a298b653dccc43a44d852001584bc22c5e00cb959246a0544044587e27ae3af6c253bf68b3dbe24a0badbe0bf55784f704d8e2f703afaed49ae6ae
SSDEEP 12288:nB3Nbw5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:B3N05mWpI2jFM5sFzfTpi4LsHof7T9sH
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a8F11.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8F11.bat
Size 722B
SHA256 5cbd957e5cbbb2ef1c509c5a91dc6f678c482f923bcdca50af571233bad6bfef
MD5 6e668b2456fa4c6d3991380a1e55dc19
SHA1 363757a679e7d3d72e861d23263bc914a79881dc
SHA512 93c0b8873585b11b390f8cbc01b7f51abe57e50d92873c410338002f35182be543442294417dc6ff5860cddfab9cb10cfc0b54f1e62aeab84bd0fddb2659a554
MD5 SHA1 SHA512

Submit Download

b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\b587553762137b14ad6390d3a62a487917256cc6d66fdbd9310eddd131982454.exe.exe
Size 60KB
SHA256 e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c
MD5 ed0fde686788caec4f2cb1ec9c31680c
SHA1 81ae63b87eaa9fa5637835d2122c50953ae19d34
SHA512 d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b
SSDEEP 1536:6HB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:6hAWJGSCTBf12Z9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 1a8911fd47aa3e98991935402374717b26afeed5d8eb431edcd4625f1a16f962
MD5 bee6df131a9c9bccab2c2e85139f6842
SHA1 d7d095b827384b3b5f4e0cf9b8afb543998f1796
SHA512 2457aa406a3010ce789237d55fa17fc0f5694c847699af8044f21ea935179ffc69056c0c2ba4ba3eee3158c51afb2d11d2c372eca3e1ca77c44545cb74cd4812
SSDEEP 768:2HJYkElOIEvzMXqtwp/lttaL7HP4EUi91acSWGoYoLVCm1:2HvaYzMXqtGNttyeiZnZLYm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\_desktop.ini
Size 9B
SHA256 f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc
MD5 5412111268dd2c1fb1cf8697bfab9b6c
SHA1 16d0b289e83c74cb50a004edd7c5750ac706f321
SHA512 13fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf
MD5 SHA1 SHA512

Submit Download

memory/1404-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1404-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4716-19-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4716-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4716-2892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4716-8704-0x0000000000400000-0x000000000043E000-memory.dmp

Download