Overview

overview

8

Static

static

3

542f22696e...b7.exe

windows7-x64

8

542f22696e...b7.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 13:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7.exe

  • Size

    5.7MB

  • MD5

    a3f75a09fc71891675dfa9c46ba0b689

  • SHA1

    853cd1c055a2813b2e8c54570a9770a120b82fc3

  • SHA256

    542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7

  • SHA512

    a2a6cb66e8c5f06c4add557f41f1ba1e36b24e37fbd7ca40df1a1455df10e3be00b77943757d29b7dd7c9abf5e02043ab2514ed921857cbe94fadd78e31f29c7

  • SSDEEP

    49152:Hd+Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTP:HdAKUgTH2M2m9UMpu1QfLczqssnKSk

Score
8/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7.exe
        "C:\Users\Admin\AppData\Local\Temp\542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4040
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC208.bat
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4956
          • C:\Users\Admin\AppData\Local\Temp\542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7.exe
            "C:\Users\Admin\AppData\Local\Temp\542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7.exe"
            4⤵
            • Executes dropped EXE
            PID:4392
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops file in Drivers directory
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:232
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3600
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1148
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3604

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
            Filesize

            251KB

            MD5

            800a15b73ebd38e1c3fab0438e16bbfc

            SHA1

            1fe5fa583af497f1606e8acff64e7277d9156881

            SHA256

            57f0772a1df0d0082fbc97f9245d3bb36d2d3edfdb49711fa28fd724750ec42e

            SHA512

            401f7cc7e2018bb4d456f21c34c174772a7422563c4272f4b0ca6b26a362d40c7dc435251b49e701aff45251fdd7488c3d9509283f36b3c6bd2923e4dc860983

            Download Submit

          • C:\Program Files\7-Zip\7z.exe
            Filesize

            577KB

            MD5

            44773e05dfe58cc6e3129ccf18cdc060

            SHA1

            97e00f69c4d47c6b46b85ddf85a45a99c3b2e5e6

            SHA256

            d76bf8b9195061b82e454ab09270b71930b68d6f4bf77a2c3d55dc475b207943

            SHA512

            56aa775567a18a4fe2c41216617568280b44a724eec1c733491309cfa88fbae256fb1aed417c669f20b0cb5f0ef7aa2e12c0f2d560fcba79377200221095adbe

            Download Submit

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
            Filesize

            644KB

            MD5

            b84328b001ca8f8af6bb91f3412d6c8d

            SHA1

            4dc7c1302ec956ad23588e6e118b529a00f78bf3

            SHA256

            7c66229128ddbb08a813f4e100c4669b0c911f85b2533b5a98c5b9c3ba1382e5

            SHA512

            3873f467b402c8cb5a09cbbc595ea38c5638aa16c008d59ddbca6ba7d7eee1fa8fc84f910de61853e3d1fe74c8bc578127165c5ce3bf1582753885b2cd8e0bc7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$aC208.bat
            Filesize

            722B

            MD5

            6031844b04258a26c4cf42e9af175642

            SHA1

            b8f8a5319d3652c926c43958c7f15eb461e27fe0

            SHA256

            7544125f6ae8e20ca907710691b1ef1c8c4ddb5310e96ef75febca009f4962ae

            SHA512

            a1b6fcad0acf33988cdac2a6d712118cdbf6f2723e8339abebef7427dbf68e79f1e2e84e9502616f1e89f1657c35beb2620f0be07ae5711a51c64e8409383f98

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\542f22696e54bbd055928ae64c17edc90f6e2e15a81dc8da3f05c8c08e5466b7.exe.exe
            Filesize

            5.7MB

            MD5

            ba18e99b3e17adb5b029eaebc457dd89

            SHA1

            ec0458f3c00d35b323f08d4e1cc2e72899429c38

            SHA256

            f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

            SHA512

            1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

            Download Submit

          • C:\Windows\Logo1_.exe
            Filesize

            33KB

            MD5

            882c518784a2516cf3382e811730a54b

            SHA1

            f005942b284152bccdaf2e9daf8dc8b7ec42ab19

            SHA256

            ed39c0d5d432a79b3535a497fdf7c83948f570ec1b744ce2c5d810ba4db5aa7f

            SHA512

            31937e85e1599160c659d430368ea36e9206bef58d98cc3642a4a8795197f7e5df96f6babbffa3d96e7b9afbb0284f03031fa6ef7361d010593df4055772093a

            Download Submit

          • C:\Windows\system32\drivers\etc\hosts
            Filesize

            842B

            MD5

            6f4adf207ef402d9ef40c6aa52ffd245

            SHA1

            4b05b495619c643f02e278dede8f5b1392555a57

            SHA256

            d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

            SHA512

            a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\_desktop.ini
            Filesize

            9B

            MD5

            e02899454c67c7d6d1af854fdcb53b67

            SHA1

            26fb213f7c299c2a4d8c4afd234ee0b751d7a30e

            SHA256

            0e67e90646d3ba7b46f935b205c9f89e8bff2dca7aeda3cd5dfb93868b262315

            SHA512

            e1519bebf62ab4cb28e630a201312812e04f815ec0663f7b68b478da97c0bf7c7c2238a8632540d3d1f37acbe83919fb198b39ebeb222c19faa2130ab65ffffa

            Download Submit

          • memory/232-19-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/232-9-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/232-3433-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/232-8753-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/1152-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/1152-10-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download