b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
Size

599KB
MD5

04417b927fecf01e5ddf04980d771984
SHA1

857210ab318d24615a1b5fbb325cbc1add42b644
SHA256

b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d
SHA512

18ae5c5bb8d221254275e3bfb708ac08e96e3be83cdb0ed413f96b738fc50832cadaaea3b88cfa4c26b75e9619106a7e480fdc313afd085fcfd3c96e77a645e3
SSDEEP

12288:L3NbtfN423weiwbjCRP33GYdGffjLFdtODEff/tKRL:L3NxFLweOkfrL/tOD2E9

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Deletes itself 1 IoCs

pid	Process
1824	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1656	Logo1_.exe
2908	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe

Loads dropped DLL 1 IoCs

pid	Process
1824	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
1656	Logo1_.exe
2908	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
Token: SeImpersonatePrivilege	2908	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2576	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	30
PID 2520 wrote to memory of 2576	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	30
PID 2520 wrote to memory of 2576	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	30
PID 2520 wrote to memory of 2576	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	30
PID 2576 wrote to memory of 316	2576	net.exe	32
PID 2576 wrote to memory of 316	2576	net.exe	32
PID 2576 wrote to memory of 316	2576	net.exe	32
PID 2576 wrote to memory of 316	2576	net.exe	32
PID 2520 wrote to memory of 1824	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	33
PID 2520 wrote to memory of 1824	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	33
PID 2520 wrote to memory of 1824	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	33
PID 2520 wrote to memory of 1824	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	33
PID 2520 wrote to memory of 1656	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	35
PID 2520 wrote to memory of 1656	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	35
PID 2520 wrote to memory of 1656	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	35
PID 2520 wrote to memory of 1656	2520	b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe	35
PID 1656 wrote to memory of 2772	1656	Logo1_.exe	36
PID 1656 wrote to memory of 2772	1656	Logo1_.exe	36
PID 1656 wrote to memory of 2772	1656	Logo1_.exe	36
PID 1656 wrote to memory of 2772	1656	Logo1_.exe	36
PID 2772 wrote to memory of 2904	2772	net.exe	38
PID 2772 wrote to memory of 2904	2772	net.exe	38
PID 2772 wrote to memory of 2904	2772	net.exe	38
PID 2772 wrote to memory of 2904	2772	net.exe	38
PID 1824 wrote to memory of 2908	1824	cmd.exe	39
PID 1824 wrote to memory of 2908	1824	cmd.exe	39
PID 1824 wrote to memory of 2908	1824	cmd.exe	39
PID 1824 wrote to memory of 2908	1824	cmd.exe	39
PID 1656 wrote to memory of 3016	1656	Logo1_.exe	40
PID 1656 wrote to memory of 3016	1656	Logo1_.exe	40
PID 1656 wrote to memory of 3016	1656	Logo1_.exe	40
PID 1656 wrote to memory of 3016	1656	Logo1_.exe	40
PID 3016 wrote to memory of 2668	3016	net.exe	42
PID 3016 wrote to memory of 2668	3016	net.exe	42
PID 3016 wrote to memory of 2668	3016	net.exe	42
PID 3016 wrote to memory of 2668	3016	net.exe	42
PID 1656 wrote to memory of 1192	1656	Logo1_.exe	21
PID 1656 wrote to memory of 1192	1656	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
  "C:\Users\Admin\AppData\Local\Temp\b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a97CD.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe
      "C:\Users\Admin\AppData\Local\Temp\b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
5d24aad0c87b50d8e77e84f7af6cf672

SHA1
e57fd1fa449180ad586fd2ebe33a6fae589dd2bd

SHA256
2177e7aaec2da47900f89fac0e3c894d182a4b53e59b8f6195b89fa03a82fde2

SHA512
f4539922a0a20488c788eed63b1c600b4e0e258b754d25dace389fbd5750be727af94bbaf8bc0b2b8ad557ecec4dae06314a6ce2a0f2a99371c9696089cc43a2

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
0a2f7bc5d2f3b1abbf852f12ac72d39f

SHA1
3ed5d15e03f4a79247638844b8e938794445bfde

SHA256
c2eadf7bc1b2c55782d5307c4bfdc59f4c900494b9a624e199c675b582a13d7c

SHA512
8c47195b5c79359b6e7c5088d1a2c757ce6a1f16dd61c4c4d0bb7baafba4135c7a64541ce7a3af55b65f83af3df2677ff6f63f9c80fdfb1f7696d54c4609d63d

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a97CD.bat

Filesize
722B

MD5
fdca3e12e180c7a44446eed287c6aed3

SHA1
ec482249b0ce83c1e8ff8dcbb88f9e5e81f5cd0d

SHA256
cb491893ffd5709cb5f761d20c40b1c8dbde7ff64cab96f2496cf7aa08f48cb9

SHA512
da15527d449e33cc3b8007eb8cfac0f482c07ae997938aca714ef04344502511c89155285c020ebdbd4a3c3fbafb8432b59b7ef33d62f95f7de2bd6d23b48d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2ce8578ed26637b7ca40e810aec6e90e7353c0408e0aa74e1a435577c97847d.exe.exe

Filesize
565KB

MD5
6677b6017e5d470cf99ef60d1802bccc

SHA1
2db730b0e0fecc40daa7bb71ea849db42aed066a

SHA256
4b18f6bbf232545f3ebe0ebb92ab5a3a7aaf6f3d49b754b29712cce013418576

SHA512
950c68bf646ef2ad7e3b9c363948fe9b732faea6e30108ff934a7a2c6a6373d9121ede15c5ca5c87292bdf8bf1d04ee4c27b73cca9f21a7d6320fc0b2ed5e0d4

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
661b4e1450972a16271f168aa4178ea6

SHA1
662406623e4e104984785be7aba37217a905c07c

SHA256
2da7ea8229edefac78402fee509ec1152315b6027878829480085315b6eabaf7

SHA512
57d6e1189c8ad8f6af2c7b1131ab3596c8ab98174aaae849e9b0ce04ac90d3845510d814bd9d3aebe49befa4d6ab28dc33bf62ee020daedb153b550f9cca1298

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
832B

MD5
7e3a0edd0c6cd8316f4b6c159d5167a1

SHA1
753428b4736ffb2c9e3eb50f89255b212768c55a

SHA256
1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

SHA512
9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\_desktop.ini

Filesize
10B

MD5
dce9bef24921d1fb94c029be04b911db

SHA1
d5ff43d520d5df3ee58c947db0b2ac3a039667b6

SHA256
c09fceb912fc9cf0f284d9d24ab0029af67d3a3bf08b81d9c0d8a7681b82c157

SHA512
cefdb984819b6b058b8d7747c2a9a74c94f6acf2728e884520154f2ffe42776f19b5a5b22b43b61acbb679acefb8489318c7be92e360a3b239ffaae445d6d97b

Download Submit
memory/1192-31-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1656-38-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-4161-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-3306-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-19-0x0000000000870000-0x00000000008AE000-memory.dmp

Filesize
248KB

Download
memory/2520-17-0x0000000000870000-0x00000000008AE000-memory.dmp

Filesize
248KB

Download
memory/2908-37-0x0000000000660000-0x000000000069E000-memory.dmp

Filesize
248KB

Download
memory/2908-36-0x0000000000660000-0x000000000069E000-memory.dmp

Filesize
248KB

Download
memory/2908-35-0x0000000000660000-0x000000000069E000-memory.dmp

Filesize
248KB

Download