Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 04:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe
-
Size
318KB
-
MD5
20a173c16e96e74dd72d4c1f007dde02
-
SHA1
2b3793d27a10a79a48b60117a6f61e4edd3a0971
-
SHA256
e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c
-
SHA512
6c2631e081d69bfae4d9593f6ce939a9a0fd6af6d08487ef1f56cbc30d498a72ff5711638ec49ebef988bb1d026ff314c51eb8ae6a7bbefebf6e73f73e294e68
-
SSDEEP
6144:F8xKWjsObiZKDAX0jH0o2zq9DmQ3LOotL4gr:FW9biZKm4H8zq9Fjtdr
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3216 Logo1_.exe 1180 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Licenses\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\command\rundl132.exe e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe File created C:\Windows\Logo1_.exe e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe File created C:\Windows\command\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe 3216 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4244 wrote to memory of 4072 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 83 PID 4244 wrote to memory of 4072 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 83 PID 4244 wrote to memory of 4072 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 83 PID 4072 wrote to memory of 3928 4072 net.exe 85 PID 4072 wrote to memory of 3928 4072 net.exe 85 PID 4072 wrote to memory of 3928 4072 net.exe 85 PID 4244 wrote to memory of 2488 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 89 PID 4244 wrote to memory of 2488 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 89 PID 4244 wrote to memory of 2488 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 89 PID 4244 wrote to memory of 3216 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 90 PID 4244 wrote to memory of 3216 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 90 PID 4244 wrote to memory of 3216 4244 e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe 90 PID 3216 wrote to memory of 4880 3216 Logo1_.exe 92 PID 3216 wrote to memory of 4880 3216 Logo1_.exe 92 PID 3216 wrote to memory of 4880 3216 Logo1_.exe 92 PID 4880 wrote to memory of 2072 4880 net.exe 94 PID 4880 wrote to memory of 2072 4880 net.exe 94 PID 4880 wrote to memory of 2072 4880 net.exe 94 PID 2488 wrote to memory of 1180 2488 cmd.exe 95 PID 2488 wrote to memory of 1180 2488 cmd.exe 95 PID 2488 wrote to memory of 1180 2488 cmd.exe 95 PID 3216 wrote to memory of 2464 3216 Logo1_.exe 96 PID 3216 wrote to memory of 2464 3216 Logo1_.exe 96 PID 3216 wrote to memory of 2464 3216 Logo1_.exe 96 PID 2464 wrote to memory of 3728 2464 net.exe 98 PID 2464 wrote to memory of 3728 2464 net.exe 98 PID 2464 wrote to memory of 3728 2464 net.exe 98 PID 3216 wrote to memory of 3488 3216 Logo1_.exe 56 PID 3216 wrote to memory of 3488 3216 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe"C:\Users\Admin\AppData\Local\Temp\e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC66D.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe"C:\Users\Admin\AppData\Local\Temp\e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe"4⤵
- Executes dropped EXE
PID:1180
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2072
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3728
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
729KB
MD5490cea4a4fe7af50e8657b765476a3b0
SHA1625ebbbb8657c7430f7bedd4d73e55c20d0ccb96
SHA256ebffa2bef19bafb870daed90cf3da2193140719ef6b33e3980c3132748afd963
SHA51278c4270c6f0bb57993502cb59a6f657045f0381ea8627d78caed68a47573997310323828a8dd16228ff79fec56c03a3526f99a2207c410cdf38a759d96312e91
-
Filesize
722B
MD57279f55494eb4ddc64ba9baa5336d713
SHA12bdbe921d5caf21027311ab76f9c4f7342ef42b1
SHA25679d62812b30e2a350747c9f5bf2aad93eeb2cd70bbffc44656c8c4a76027ce31
SHA512ced1802b01a2cf4542d58a8ec0a7bb2f0be2546c905a970096070934f511199180b82055703e7832f61f9e0385afaffe5fc548e7514215d6c37ebb034fe49c6a
-
C:\Users\Admin\AppData\Local\Temp\e404f209fb43a16bcc1cd873641c31a9cd0e604928d28b2a9b6f9862a99ebc1c.exe.exe
Filesize273KB
MD555e392d1bd55a1292b6ce766225416e5
SHA106d8134a3002e6974407fb5da0a59ab43415a52a
SHA256db42cb95904cfc6891df2aa736506fb34a26cf9a26e88ab0ef262e0459344a3e
SHA5120c55062cf8debbdf1a7a4f41527e43cd124fb7777e9b930de9cc900abf9c27a1956a536200e23dddc9a4068ac5bc9a8052299a4f2cf010cffd205a32d99581a2
-
Filesize
45KB
MD51252c4075de38433d93b350979f643f0
SHA1d2d8b7e98c144d404168823d1ab6f2914c1bc5ea
SHA256dc7fafe33a8f2a5583884c74c25fdf4cb78cab8362d3dc46ba3805694d399f87
SHA512aa0f3db7a488613cb24a431d34147d09bf2cfa61c3a78eeffb7945832a2a72ed1515309753a0a7d422d76d7d1b459b9b7626dff3726b9a7b8f05ce08da14b0c0
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
10B
MD5b234f65c842f48c59a94b913a3a270d2
SHA12caeaf8fe301b48b9c9195fae787e987e3d209ab
SHA256d2077e75e01aa96dc8079388609587061dab8165a9685c5cb1570fbb55f5a91a
SHA512efae04d13638d5d9253f4dd5ff53cb38d78004911d3e0126192421901fe7be04d248ce2bfb236b792c69d9e444e1a48234dfe345166ada5855c08b4813d35077