Malware Analysis Report

2025-03-15 04:21

Sample ID 241026-a1bwssyanm
Target 9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53
SHA256 9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53
Tags
discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53

Threat Level: Shows suspicious behavior

The file 9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Deletes itself

Loads dropped DLL

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-26 00:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-26 00:40

Reported

2024-10-26 00:42

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

C:\Windows\Explorer.EXE

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Mail\WinMail.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Uninstall Information\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Mail\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\it-IT\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Mail\es-ES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Logo1_.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2112 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 2112 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 2112 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 2112 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 1948 wrote to memory of 2916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1948 wrote to memory of 2916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1948 wrote to memory of 2916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1948 wrote to memory of 2916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2112 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 2112 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 2112 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 2112 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 2100 wrote to memory of 2688 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2100 wrote to memory of 2688 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2100 wrote to memory of 2688 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2100 wrote to memory of 2688 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2400 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 2400 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 2400 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 2400 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 2688 wrote to memory of 2648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2688 wrote to memory of 2648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2688 wrote to memory of 2648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2688 wrote to memory of 2648 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2100 wrote to memory of 2656 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2100 wrote to memory of 2656 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2100 wrote to memory of 2656 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2100 wrote to memory of 2656 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2656 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2656 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2656 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2656 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2100 wrote to memory of 1128 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2100 wrote to memory of 1128 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe

"C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$aB0A9.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe

"C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

N/A

Files

memory/2112-0-0x0000000000400000-0x000000000043F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aB0A9.bat

MD5 3b894f00428ec3c8cd7afc72f34eb879
SHA1 c3b0c580c7af38831dc318444c9a938db396e2dd
SHA256 e95d707bd90b7398da36d8d4b761f14799d77c72401a4e435fa28f56abe1c1ea
SHA512 0d4e6c3fc1989bae54add4c34e4bf5ed2cdd0b2635451e175b061182cf475eaad3b1275ec17421477850c54b4d718377abb90c91dee4d7da7c5ce4bc2586fecb

memory/2112-12-0x0000000000280000-0x00000000002BF000-memory.dmp

C:\Windows\Logo1_.exe

MD5 ad497e47848f62a27a1051e5bbe43789
SHA1 0ddea8e45a900b14557ebbe9569bf7ec574f4374
SHA256 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37
SHA512 09eba4fb3e1129546cb90e4d012210f03ddb45993ce05e17241af7eeac7051cfd73ef8d38ec1c3682f9b244481ef6921c6d89b128a7dc41d3fceaa8f160f1936

memory/2112-17-0x0000000000280000-0x00000000002BF000-memory.dmp

memory/2112-19-0x0000000000400000-0x000000000043F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe.exe

MD5 555d7a9a45844e061845877f095d017b
SHA1 4b4269c1e2e29cd78c141fb66bb2965b04411033
SHA256 e86340a88f90a53d01d26629d517889aa12f5dc0150e5cb0bf8731bc2bce96ca
SHA512 c243d3bd51b891aff87718019d964189dee4f783ecef1f15bf0e2a378367e99d9844cbd527c70f5d6df373dd171da4bce03f4632e55c98e7bcc3335f20b0eb16

memory/1128-28-0x00000000024E0000-0x00000000024E1000-memory.dmp

memory/2100-32-0x0000000000400000-0x000000000043F000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\_desktop.ini

MD5 28a582403dbb209b6c5cb7bada9c918d
SHA1 db58560be63032a4cbd738d2d639e5bf764d6277
SHA256 b5a9fa3acde4d9499ea08a6d9ff193fc9cda57f04141f82d2422a4008f451200
SHA512 511b4d3886d671d01c66d2509b784a199e68a00f2597d311d8d0770f0b1030680136ee450343a8d6c4b51d9de8448bafdde44dc1a1c6e62bccde47d5af03fbae

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 ca511b302bdc164c9d8e535ac6f6b997
SHA1 30cb230cc8899bdd7026d178adbc9fbc382cd851
SHA256 2dfaac89ab7709d22eb4d9f70e03ac057347ea9a0787fcefd7e8e78a022b46a6
SHA512 a55164e798ef20915db78364fb4c59e239cdfd8b4e5ef8ca3887e1dcd2a5c01378f82a1a55f13f3e8b94d870bb53bd8e4f61a8649189436bea518f30d7449d53

memory/2100-2858-0x0000000000400000-0x000000000043F000-memory.dmp

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 6022229300c8c638269c18b6497fe389
SHA1 25fcb5d4ec2c5bf1bebcd7fdf1a82146c1ff0816
SHA256 92f36e5d1ef97a8fed3d8f45c8ed54ea7987579a00f0fb976c1a4c200acc38c9
SHA512 abce1c611c18a701ee9fb49cd535e4c396367427d1e63251917c1a069d4b03e6ee1069959e0cb6cb914240137abb0475d5e30df088e1a90ec5940b785169d4fc

memory/2100-4193-0x0000000000400000-0x000000000043F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-26 00:40

Reported

2024-10-26 00:42

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

141s

Command Line

C:\Windows\Explorer.EXE

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini C:\Windows\Logo1_.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Defender\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File created C:\Windows\Dll.dll C:\Windows\Logo1_.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Logo1_.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4700 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 4700 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 4700 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\net.exe
PID 4932 wrote to memory of 3536 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4932 wrote to memory of 3536 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4932 wrote to memory of 3536 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4700 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 4700 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 4700 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe C:\Windows\Logo1_.exe
PID 5012 wrote to memory of 3880 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5012 wrote to memory of 3880 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5012 wrote to memory of 3880 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 3880 wrote to memory of 1592 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3880 wrote to memory of 1592 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3880 wrote to memory of 1592 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2564 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 2564 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 2564 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe
PID 5012 wrote to memory of 4460 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5012 wrote to memory of 4460 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 5012 wrote to memory of 4460 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 4460 wrote to memory of 3820 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4460 wrote to memory of 3820 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4460 wrote to memory of 3820 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 5012 wrote to memory of 3520 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 5012 wrote to memory of 3520 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe

"C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6830.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe

"C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 210.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4700-0-0x0000000000400000-0x000000000043F000-memory.dmp

memory/5012-8-0x0000000000400000-0x000000000043F000-memory.dmp

C:\Windows\Logo1_.exe

MD5 ad497e47848f62a27a1051e5bbe43789
SHA1 0ddea8e45a900b14557ebbe9569bf7ec574f4374
SHA256 5367a74fadfdb8b7a28120e69edfffbe94b1e7c0757fa55e58d1501ccdfe3d37
SHA512 09eba4fb3e1129546cb90e4d012210f03ddb45993ce05e17241af7eeac7051cfd73ef8d38ec1c3682f9b244481ef6921c6d89b128a7dc41d3fceaa8f160f1936

memory/4700-11-0x0000000000400000-0x000000000043F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a6830.bat

MD5 6684ce4836db42452d17fb6aee3667b5
SHA1 d8848ee8f1720c7d551d03e658c36367a29690e6
SHA256 b357756362e77db7753843498f7f1ec1ee6f4dd40890111a973c35ea3eb15798
SHA512 e04c7bd8db0c7a6cad5223b093a50eb7493cc68227fc0fd5cf767ff7df0439bda72aed68b1715f4294e64addd639c6c130f8db1d9130778f6690c9d39ce61aff

C:\Users\Admin\AppData\Local\Temp\9a270c57683231bf425d4984f659de7fc1ceb510b7a56f06a0e5feec785a2b53.exe.exe

MD5 555d7a9a45844e061845877f095d017b
SHA1 4b4269c1e2e29cd78c141fb66bb2965b04411033
SHA256 e86340a88f90a53d01d26629d517889aa12f5dc0150e5cb0bf8731bc2bce96ca
SHA512 c243d3bd51b891aff87718019d964189dee4f783ecef1f15bf0e2a378367e99d9844cbd527c70f5d6df373dd171da4bce03f4632e55c98e7bcc3335f20b0eb16

memory/5012-18-0x0000000000400000-0x000000000043F000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-493223053-2004649691-1575712786-1000\_desktop.ini

MD5 28a582403dbb209b6c5cb7bada9c918d
SHA1 db58560be63032a4cbd738d2d639e5bf764d6277
SHA256 b5a9fa3acde4d9499ea08a6d9ff193fc9cda57f04141f82d2422a4008f451200
SHA512 511b4d3886d671d01c66d2509b784a199e68a00f2597d311d8d0770f0b1030680136ee450343a8d6c4b51d9de8448bafdde44dc1a1c6e62bccde47d5af03fbae

C:\Program Files\7-Zip\7z.exe

MD5 6eba064bf332827bc1aa1a52aa4cb319
SHA1 0a40d3072e22696ba5e747b69b8d8496e44470ab
SHA256 8582ff82b3f7bfa3232ac60a14ab59d50dec8c57a9c7d47413be11ffc23c36c9
SHA512 7aeea966baa2dc2ed0a0da2c875a64cbb031fe0b055c2ef0230fa7259b7cb03f484c6a3f99a5de53ae18fa31948dab3b3319df12dedf98e12df84387a417a471

memory/5012-3544-0x0000000000400000-0x000000000043F000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

MD5 a2f4a30c61702f94a9f13287448a3eeb
SHA1 039f83e180211d88c13a4132bd4f8b1732dcddf0
SHA256 68309d1c6fa8dda2d2ff3aaf12ae90297e2e1b0dfc0584c85d0607a8d463a26b
SHA512 ce6beacc74d38d7033da45dd8e636a321105b5054bc84bc2100476afe7ed622ba6cb7324f9d2cf5d867af0f076ea79ea1a9d1825450e065a803cb8eb472f6fe7

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

MD5 6cfecaa336a254849375a2c8c8a96643
SHA1 485edaaafe1edf6c0aeaa8922d5f5d0fecc6e1e2
SHA256 615086abf4d14c6328dabdb7c9ab15008efc61a4fca66274f73529c276f6db65
SHA512 de1050e2dd1892cfae42023f3b9b855357bbc3be5a5dfa63248fb933161a4404e350a48f83818bd541268e7f2cbacb312989fe488446c85e6cbc68390a2c6163

memory/5012-8764-0x0000000000400000-0x000000000043F000-memory.dmp