Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 16:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
General
-
Target
545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe
-
Size
368KB
-
MD5
7a3997615d706fd077d1e2032308e73b
-
SHA1
a1eecfb29235f6322f9655c9fcae8c71d32c7778
-
SHA256
545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033
-
SHA512
ac9b0724574606351a56224d8cf6866b102ff55bf917891b8151cdddf93776696979af0e823ecb525f179c46bb23c1cdf4a64693726ded54f4bb231e5e370add
-
SSDEEP
6144:bZ1oqzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:bZ1NU66b5zhVymA/XSRh
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1968 Logo1_.exe 2188 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Multimedia Platform\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe File created C:\Windows\Logo1_.exe 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe 1968 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3648 wrote to memory of 3668 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 83 PID 3648 wrote to memory of 3668 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 83 PID 3648 wrote to memory of 3668 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 83 PID 3668 wrote to memory of 744 3668 net.exe 85 PID 3668 wrote to memory of 744 3668 net.exe 85 PID 3668 wrote to memory of 744 3668 net.exe 85 PID 3648 wrote to memory of 1064 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 89 PID 3648 wrote to memory of 1064 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 89 PID 3648 wrote to memory of 1064 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 89 PID 3648 wrote to memory of 1968 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 91 PID 3648 wrote to memory of 1968 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 91 PID 3648 wrote to memory of 1968 3648 545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe 91 PID 1968 wrote to memory of 3308 1968 Logo1_.exe 92 PID 1968 wrote to memory of 3308 1968 Logo1_.exe 92 PID 1968 wrote to memory of 3308 1968 Logo1_.exe 92 PID 3308 wrote to memory of 2364 3308 net.exe 94 PID 3308 wrote to memory of 2364 3308 net.exe 94 PID 3308 wrote to memory of 2364 3308 net.exe 94 PID 1064 wrote to memory of 2188 1064 cmd.exe 95 PID 1064 wrote to memory of 2188 1064 cmd.exe 95 PID 1968 wrote to memory of 1904 1968 Logo1_.exe 96 PID 1968 wrote to memory of 1904 1968 Logo1_.exe 96 PID 1968 wrote to memory of 1904 1968 Logo1_.exe 96 PID 1904 wrote to memory of 3700 1904 net.exe 98 PID 1904 wrote to memory of 3700 1904 net.exe 98 PID 1904 wrote to memory of 3700 1904 net.exe 98 PID 1968 wrote to memory of 3484 1968 Logo1_.exe 56 PID 1968 wrote to memory of 3484 1968 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe"C:\Users\Admin\AppData\Local\Temp\545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D69.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe"C:\Users\Admin\AppData\Local\Temp\545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe"4⤵
- Executes dropped EXE
PID:2188
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2364
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3700
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5c9bce56e6c73940b71a024d031d67e29
SHA1c03ffbbc7e3837bc5cbabd2eacccecfff624607c
SHA256c5743ab362bab4eb252577ea5c1fb1bf9dce9a6ec0db29ad2b29acd450c4c44b
SHA51232e59e499a9d7a9c907e638a00f06e69f6ce00c87fec22d1cb0b2b40f5cc9668794cd7eac3fe590b4999f22dd6d927968cf0c21bff1c0af15eac381759a4ca27
-
Filesize
577KB
MD563dbbfc836380251ebca4f61580f1814
SHA16c16254aaeb7f1a86097f6c9220d092730bfe36e
SHA2560cbdf5963d6e01bee0f4db2543b2295b97fc3e8ddf3fda5b38974e56a805fba5
SHA51237033d1c0557af1f07399b4043f7cfd62e27cc5060c91b3179a96fb0c8401de57e566e77c3634d9c18cc41c19131476d359a5adbdb16f1891c6572f96fbb3d24
-
Filesize
722B
MD5d21b6d9318404a937d95bce381796c2c
SHA11495ee6822b9a5a0e3f9c4e57a547866daed7e09
SHA2567211ab7754bdf1e891e58e5fb10d219d54bf2233d9f6392f806669022a996279
SHA512d71a8497ee06de9a79a3f0ba7f9af88314bca03b083e36c840113a56bafd84c57f5eb94dc5228a69dc9997b4d3ad114a76f77a4dc491d2e23342e68b74a16307
-
C:\Users\Admin\AppData\Local\Temp\545aea539cf2e804b8ea386de6dadfb0a41ac24b1688cba5de74b5f4ad0d8033.exe.exe
Filesize335KB
MD540ac62c087648ccc2c58dae066d34c98
SHA10e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA256482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
SHA5120c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
-
Filesize
33KB
MD5c4440056e06065be031cfa6acd94c763
SHA16c1f366e99fb096685fe30bab2f51d0a41dc7188
SHA256878628fbd3611ca93730e8df7e81fa34165480a71e875cbfc192fb83f97e386e
SHA512e8301dc938a9bc3b2205951171ca38d7c441e425d4d8e1e97ad82fb2b2f519ad4b9774d58b482183a50b769a7a16ec951ea828755c7433b454016b0fae2c86d4
-
Filesize
10B
MD5291aa08828faa68893c7f89a0dfc158b
SHA1fcae3d190f0d8c14b44dc2be0b627b0680d2eab9
SHA256f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841
SHA5129c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38