Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 20:16

General

  • Target

    6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790.exe

  • Size

    11.1MB

  • MD5

    03e0d68de934dd404d7c5f764e383c3e

  • SHA1

    49f2234a66d178a2c11bee3bd4170458220127c5

  • SHA256

    6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790

  • SHA512

    dcb61014a102cb71fdec807303b80fe05b3df791cc34689470d7c1d8e0a59851b64373920de64118b9e3e32ad411419e6523b2485a15668e218a667e8a146235

  • SSDEEP

    98304:Mdfb+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9Y:MJ+kIGv3y/x+KTbfjJ+kdnAlejY

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790.exe
        "C:\Users\Admin\AppData\Local\Temp\6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3052
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aA969.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Users\Admin\AppData\Local\Temp\6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790.exe
            "C:\Users\Admin\AppData\Local\Temp\6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790.exe"
            4⤵
            • Executes dropped EXE
            PID:2884
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops file in Drivers directory
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2116
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2836
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2500
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2656

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            1012baacf238028b5b3571597eafb677

            SHA1

            2828da20e2d8eab5c6cbe26acdf69d511774a329

            SHA256

            453165e0ee705f5960702b7621316cdfc9e66b7b11a40050bd4983339579c96c

            SHA512

            ebe0346fb4c06e6ccd0ccb1d535d41e638bc95311c659490be8d1d88c74c3079b87724e189218bb27b3dfd3c91d61e9ab1543f5907f63cd3955b7dff01af436f

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            70cb7c4cc1ca5f96aa18c5d09c77915d

            SHA1

            3248385072ed80b1437bae96c5a9b3d55efaefac

            SHA256

            07a519caf26b0d9761c1c7a0f9b67ef4b53d046ba58a5cc9bf3332ede942734c

            SHA512

            fec323695ae348d9beccd890a9f52ec94188823cede88b52ebcdd7585ff2acfc9e4690403fdd7878e8f5fd2926a5f30a6b20815d9182e2afff3f226671536183

          • C:\Users\Admin\AppData\Local\Temp\$$aA969.bat

            Filesize

            722B

            MD5

            395b7ddbba9eda839e71eea9bf36a35f

            SHA1

            6929ee22a4fb3a76fd6123da3171ae2f0db3919d

            SHA256

            24c4a8c8798d366bf53bb408ea7d59eb8c85ee1257d28c0021f0d2a315037cab

            SHA512

            ea5ee3718252558ea1ea5a2b5eb711f02034af8b327577883365901156bbd4885ecbdb8f587aa54c69f91d2d490a7ae2b326b7c2330cf08fd3744de3e6dcc995

          • C:\Users\Admin\AppData\Local\Temp\6d797d3d0c3a58bf8edfdc6decb692cd4e0a42062e1a93e721fdc35c98a1f790.exe.exe

            Filesize

            11.0MB

            MD5

            b45b7bd6eb92c5b65378d8d0a0964747

            SHA1

            5ca6f198ac83c90496110259b57ff4a5f47b64bb

            SHA256

            5f1d9218f9735a763ffecc47c7b6f0c342b7f1a5da835733e0b3b73903f864a0

            SHA512

            bde39c4b6d04caae8280bdd53e6036c53ed394a72f0d4d1273c149175570e8a87f87c8963869c96834fef7e82893da38c49ce4aaa1851e65c055dbbcac7c1708

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            dfc4e131e84f5b4aa301491d0d5c735f

            SHA1

            f4efee0061dee53da9d73f70648ae8ad2eeb6473

            SHA256

            f9508caee8e59955142464761783f89d580b4ac080f2d8256d6bf547e1958ba9

            SHA512

            62652d0c21a71e52777c3e929013f838e0907a21259e2947bf46e698fb90597309cdbce5f1c656022e98bf14588386d1c9c5559658392e29c1da2b86ba0221c0

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            832B

            MD5

            7e3a0edd0c6cd8316f4b6c159d5167a1

            SHA1

            753428b4736ffb2c9e3eb50f89255b212768c55a

            SHA256

            1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

            SHA512

            9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

          • F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\_desktop.ini

            Filesize

            9B

            MD5

            577b020fd4f1c33364f7dc1b6a15b5e0

            SHA1

            0a39afa020279d2ae46b302efe9dfd550e822709

            SHA256

            e22c9759bcf5bc35063c6c048e109883f070723446b9ed5d16e70c48ca526bb9

            SHA512

            c7b8e4478ddc648c13acd21b16fa7397fad334d7710e3d91f4069fcd7d5a4f3d8c542c46eb3843c4dbc8d862bf03a50d1ad641e725f53382a73a9ac4ec035f48

          • memory/1212-29-0x0000000002D80000-0x0000000002D81000-memory.dmp

            Filesize

            4KB

          • memory/2068-17-0x0000000000230000-0x000000000026E000-memory.dmp

            Filesize

            248KB

          • memory/2068-32-0x0000000000230000-0x000000000026E000-memory.dmp

            Filesize

            248KB

          • memory/2068-18-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2068-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2116-33-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2116-2962-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2116-4151-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB