Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
General
-
Target
b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe
-
Size
120KB
-
MD5
89d0ef0f351ec697dad109c133d71d5f
-
SHA1
b87b217b4d9023143ea4bd42eff931ac4edd76c6
-
SHA256
b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2
-
SHA512
b35c46942424f2e4521360166a6faa28771c6efbe0d5a612b9a3e266a1298e6da21d7de5d28294db6ae772b1dd7df6849a827c8e95e7b81d415e9b66da9fcc5e
-
SSDEEP
3072:qKtfDwsjPThTYszDH2fhhiWwCALQ703KLTes85I4Dk:BtfDwsjPThT5zL2mo4V3KPjR4Dk
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2796 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2820 Logo1_.exe 2908 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe -
Loads dropped DLL 2 IoCs
pid Process 2796 cmd.exe 2796 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe File created C:\Windows\virDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2820 Logo1_.exe 2820 Logo1_.exe 2820 Logo1_.exe 2820 Logo1_.exe 2820 Logo1_.exe 2820 Logo1_.exe 2820 Logo1_.exe 2820 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2796 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 31 PID 2248 wrote to memory of 2796 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 31 PID 2248 wrote to memory of 2796 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 31 PID 2248 wrote to memory of 2796 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 31 PID 2248 wrote to memory of 2820 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 33 PID 2248 wrote to memory of 2820 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 33 PID 2248 wrote to memory of 2820 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 33 PID 2248 wrote to memory of 2820 2248 b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe 33 PID 2820 wrote to memory of 1204 2820 Logo1_.exe 21 PID 2820 wrote to memory of 1204 2820 Logo1_.exe 21 PID 2796 wrote to memory of 2908 2796 cmd.exe 34 PID 2796 wrote to memory of 2908 2796 cmd.exe 34 PID 2796 wrote to memory of 2908 2796 cmd.exe 34 PID 2796 wrote to memory of 2908 2796 cmd.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe"C:\Users\Admin\AppData\Local\Temp\b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aEC14.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe"C:\Users\Admin\AppData\Local\Temp\b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe"4⤵
- Executes dropped EXE
PID:2908
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5c522abdf6223dc38c92aaeef239b3a73
SHA1bf5986966bae5077eeef917c0bac397996d75f7f
SHA25656e0ba68ae7e8069063afe5c4c51e609cd1eaaa1ebdbb811cc1eb83c3b5717ef
SHA5125df15d76f03183532a41afb420e09b2ac96089a57f9c8fea4948733410de4cba0a6147be96e70d7bd1fb2c1a0307bc9e0db43a8ec6344783b25f650278eda3fd
-
C:\Users\Admin\AppData\Local\Temp\b4fac2c87fe87f91e22bcda2ee06d6def08e11843833622b9b905533bf3074d2.exe
Filesize61KB
MD5a974a1ba752263965a36032abbf355bd
SHA1c86c1d8fa9158754bcacfc1cdaf6fd3756b6d8d3
SHA2569e20583e3cee6094d25c72741b51acc888c8661346666b4641112baa90066769
SHA5128eac9b149f1b452ba1620fadb435bd2ea1aa4e9cbf7b8dac63d8f6521bd2c39f5447e93e682545ad7a7f7468a454d413b702bbbfe65a6b3d6436fc9b0a826ab6
-
Filesize
58KB
MD5f7f5eb48411808b9b8f78784550ab902
SHA1711c76e51664a533a4223ada6eae1d86bb103327
SHA2561fe1d7738df394db3c60d7a95515134adb22fb7e5a552b1c9b7635a7fa6b977c
SHA51261d8ab58e4c2cbf738459f5947dedae3423b68d355bc6db072878d2fade6223c8e5a7280e485ec3879ad609670f571ddb72b57ca053493987c85b6666d09e7be