Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 00:03

General

  • Target

    74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e.exe

  • Size

    563KB

  • MD5

    86bb6b739bb4d22e1810d41cbfe6a29e

  • SHA1

    6b9bd695ad29d47ccf580982561586c3a4856ddf

  • SHA256

    74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e

  • SHA512

    cc78b82d7a7f5c1bc7168262276ea0a419dba339b47e34ebc60bec87298d993b84f982f41104ed86fa0a030783c06aaf953fb768498b410974aa78090f14e165

  • SSDEEP

    12288:V3N2rc9iJafmm2VYK+UNo0RweQfoAxHv9sN4A4H9J618UtQ43iUa:V3N2hVm2VZQwy9E1Vf3M

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1236
      • C:\Users\Admin\AppData\Local\Temp\74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e.exe
        "C:\Users\Admin\AppData\Local\Temp\74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2436
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aC735.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2372
          • C:\Users\Admin\AppData\Local\Temp\74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e.exe
            "C:\Users\Admin\AppData\Local\Temp\74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e.exe"
            4⤵
            • Executes dropped EXE
            PID:2744
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops file in Drivers directory
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2868
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2824
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2780

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            a89c97a5c062d1d26e8beff77bb2182b

            SHA1

            0b073020b2274e21934f8551aef4c069caed20e6

            SHA256

            07c0736b0f1f7d9032b9b9b030a58aae57bfded17fd2d81b9c2d6e22c9e36aec

            SHA512

            c4374b52fa9340a73d213366b38ea5571ad5840ba491271b17bf1ba81af33f865ab41e317aad946414040e27560d86a72911e48e6408cd438b08b34a95851e1a

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            70cb7c4cc1ca5f96aa18c5d09c77915d

            SHA1

            3248385072ed80b1437bae96c5a9b3d55efaefac

            SHA256

            07a519caf26b0d9761c1c7a0f9b67ef4b53d046ba58a5cc9bf3332ede942734c

            SHA512

            fec323695ae348d9beccd890a9f52ec94188823cede88b52ebcdd7585ff2acfc9e4690403fdd7878e8f5fd2926a5f30a6b20815d9182e2afff3f226671536183

          • C:\Users\Admin\AppData\Local\Temp\$$aC735.bat

            Filesize

            722B

            MD5

            aecb9c5aa924989a304372a5a00833d9

            SHA1

            9451a959c8cf4fcc2edaecc14290bb2b1a57a0ee

            SHA256

            8d0147032f1eae03aafbabc1fb7537195fefebb7ccbc666d88042078a7115108

            SHA512

            410a0433f1e73e1b94515b7db147181bb95f10c4d70bbdca306bd501df4d87e248f9ad651238341ed58ff38e9c8a69d3ed79767e773dfa730f358222e13d5077

          • C:\Users\Admin\AppData\Local\Temp\74537b0528ce6c8892e73a92fd4c92bcbb16afae1267b75e655899d104da587e.exe.exe

            Filesize

            529KB

            MD5

            cca0c5482b8a6a275d9d49433f435dfa

            SHA1

            a72ae8621386e13c34055f612ae7612b8a18a39e

            SHA256

            6ea08bbcedf7cb51cfbe4896ef8c589a4568b1d5240265b1dcfda83dc8b55365

            SHA512

            b88f5cdb4bc08429ca40d24cef490128d341e10615d1d93d084b3247c2b28573d177d878c1385d3941e16a8bcc8a9f6b7870c152f4a43d02e69c05defcc9196e

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            3dad059e7aec47d7f38f17c930a767d0

            SHA1

            e3d77ab88d5e22af5fd87ae4c9a42c4722197dee

            SHA256

            4303680f3967f272c366da0600b22488a03de4e09f605b8e77ee0b0ba0836ecb

            SHA512

            2a6e399ed54c132c692dc89ead3f330990d9f88ed5afb73fe1b9e5906f30b46d9edf8b34eacd690dafcf1fa380aad934c72fa011f3a3bbd8f1c409d424345a02

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            832B

            MD5

            7e3a0edd0c6cd8316f4b6c159d5167a1

            SHA1

            753428b4736ffb2c9e3eb50f89255b212768c55a

            SHA256

            1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

            SHA512

            9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

          • F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\_desktop.ini

            Filesize

            9B

            MD5

            577b020fd4f1c33364f7dc1b6a15b5e0

            SHA1

            0a39afa020279d2ae46b302efe9dfd550e822709

            SHA256

            e22c9759bcf5bc35063c6c048e109883f070723446b9ed5d16e70c48ca526bb9

            SHA512

            c7b8e4478ddc648c13acd21b16fa7397fad334d7710e3d91f4069fcd7d5a4f3d8c542c46eb3843c4dbc8d862bf03a50d1ad641e725f53382a73a9ac4ec035f48

          • memory/1236-31-0x00000000024D0000-0x00000000024D1000-memory.dmp

            Filesize

            4KB

          • memory/2148-20-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2148-13-0x0000000002FA0000-0x0000000002FDE000-memory.dmp

            Filesize

            248KB

          • memory/2148-18-0x0000000002FA0000-0x0000000002FDE000-memory.dmp

            Filesize

            248KB

          • memory/2148-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2276-35-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2276-2964-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2276-4154-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB