Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 08:24

General

  • Target

    167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5.exe

  • Size

    583KB

  • MD5

    9a107d347610b8a0c9aaf492ed6a5e8d

  • SHA1

    26e6dc683a9a4a00a6adf3601a11e5a679ab8b29

  • SHA256

    167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5

  • SHA512

    ca09f3c4b15e74b678cf6e199f55c6d462e15495226fa915031ee5e36f212d8e1a0814d4841ced27bd06f3de3dbf60c1b809086b4cea5b8bf2692b8de0fe148d

  • SSDEEP

    12288:x+azbvt7a3iwbihym2g7XO3LWUQfh4Co:xBzbA+gkE2fh4Co

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3588
      • C:\Users\Admin\AppData\Local\Temp\167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5.exe
        "C:\Users\Admin\AppData\Local\Temp\167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3140
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3D1.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3824
          • C:\Users\Admin\AppData\Local\Temp\167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5.exe
            "C:\Users\Admin\AppData\Local\Temp\167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5.exe"
            4⤵
            • Executes dropped EXE
            PID:4400
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4788
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1268
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2708
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1136
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      583KB

      MD5

      9a107d347610b8a0c9aaf492ed6a5e8d

      SHA1

      26e6dc683a9a4a00a6adf3601a11e5a679ab8b29

      SHA256

      167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5

      SHA512

      ca09f3c4b15e74b678cf6e199f55c6d462e15495226fa915031ee5e36f212d8e1a0814d4841ced27bd06f3de3dbf60c1b809086b4cea5b8bf2692b8de0fe148d

    • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

      Filesize

      649KB

      MD5

      33d1fbbb3236bc3a2843e45b01da9c5d

      SHA1

      c0847581b9a49f6b37cf8e6785578ea96b4de8a1

      SHA256

      48817c256c311abe3645d6b5a56e4c0361b9e781943bf5301951efa87e694ea0

      SHA512

      1e2692e1701ba9ba3d8d8a6420458270526a519eb413d725757e58133abcbd9d5835255d54e4f188da51e01635b974f50fafc5abc558c959f3c43ecb051c9274

    • C:\Users\Admin\AppData\Local\Temp\$$aA3D1.bat

      Filesize

      722B

      MD5

      dab679ccfe5dca46cd009fda76ed1a87

      SHA1

      f6184216d9b72d276ead13914e467a06f61e7db2

      SHA256

      87b14cf68c44f587040d58fdfb269522052f0dac92bf7a539a1e4da5045c5337

      SHA512

      80a232a12261fdbf30757575e7e9eb85bb077707cef432a5be9fdea2fc0e35ee088f5cd11da5a66b5b447870fc1bd4dbd6a233a8cf764f4ad378e988be76afc8

    • C:\Users\Admin\AppData\Local\Temp\167aa5ede83a858c0b43b5635f716071ad8cb4834c08be0ecf53314f00df77a5.exe.exe

      Filesize

      544KB

      MD5

      9a1dd1d96481d61934dcc2d568971d06

      SHA1

      f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

      SHA256

      8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

      SHA512

      7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

    • C:\Windows\Logo1_.exe

      Filesize

      39KB

      MD5

      a71bfcd1ef96edb3cc326e1b76824622

      SHA1

      387956a928cafd3b7bf815274ac9ddfb01e59562

      SHA256

      0cd414bed04b78dd4100d3bdddc3fa140a3558caf58072d00359f3e88760c370

      SHA512

      3add11586e4795a4c92b18fc12e0639beef6f2b60f7c5db7276c94f88f2aab7a9c4ad0ad2b60b48646eabc9a5a6cd3607c539223fc210201da7963caa5b7dc92

    • F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\_desktop.ini

      Filesize

      10B

      MD5

      688d58fa5756a393f9472937ef284c25

      SHA1

      18ee07a5ee8de4fbd046763cd4a55ef2e6c3f808

      SHA256

      e21f27bdf2d90c77d75658b5217d5af4519a6c1bfc326a109eb4a085a2b83302

      SHA512

      c84930eb323c71ffc1edac543a2f60e366de40b39a88b18dba09c1272fae0b12262f4fae496bc9546598507fc37729d829f93b101bbec4739a05be33e0010a3f

    • memory/4788-1659-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/4788-18-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/4788-9-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/4788-5571-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/4788-8909-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/5088-11-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/5088-0-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB