Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2025 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
General
-
Target
2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe
-
Size
141KB
-
MD5
2fb51c7043d4c1f4e4017f14c03f2066
-
SHA1
a72c0944dfa7549a08c0a49679b79b9bf29c7715
-
SHA256
2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893
-
SHA512
4b2a1715db7cf7eca7def242ea857741b8c58d753314f3dc2b35fce0ef97b6e18d3243b824016344f6ca7d65a28248cd5f9c093c8191b04ebb08d4df6dcc145c
-
SSDEEP
3072:JA/aY46tGNFC0VF+sRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:SR46tGfC0jJYHKreQ32hlBG
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3596 Logo1_.exe 904 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe File created C:\Windows\Logo1_.exe 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe 3596 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4468 wrote to memory of 1632 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 83 PID 4468 wrote to memory of 1632 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 83 PID 4468 wrote to memory of 1632 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 83 PID 1632 wrote to memory of 1772 1632 net.exe 85 PID 1632 wrote to memory of 1772 1632 net.exe 85 PID 1632 wrote to memory of 1772 1632 net.exe 85 PID 4468 wrote to memory of 1548 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 86 PID 4468 wrote to memory of 1548 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 86 PID 4468 wrote to memory of 1548 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 86 PID 4468 wrote to memory of 3596 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 87 PID 4468 wrote to memory of 3596 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 87 PID 4468 wrote to memory of 3596 4468 2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe 87 PID 3596 wrote to memory of 1136 3596 Logo1_.exe 88 PID 3596 wrote to memory of 1136 3596 Logo1_.exe 88 PID 3596 wrote to memory of 1136 3596 Logo1_.exe 88 PID 1136 wrote to memory of 4604 1136 net.exe 91 PID 1136 wrote to memory of 4604 1136 net.exe 91 PID 1136 wrote to memory of 4604 1136 net.exe 91 PID 1548 wrote to memory of 904 1548 cmd.exe 92 PID 1548 wrote to memory of 904 1548 cmd.exe 92 PID 1548 wrote to memory of 904 1548 cmd.exe 92 PID 3596 wrote to memory of 3032 3596 Logo1_.exe 93 PID 3596 wrote to memory of 3032 3596 Logo1_.exe 93 PID 3596 wrote to memory of 3032 3596 Logo1_.exe 93 PID 3032 wrote to memory of 4360 3032 net.exe 95 PID 3032 wrote to memory of 4360 3032 net.exe 95 PID 3032 wrote to memory of 4360 3032 net.exe 95 PID 3596 wrote to memory of 3444 3596 Logo1_.exe 56 PID 3596 wrote to memory of 3444 3596 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe"C:\Users\Admin\AppData\Local\Temp\2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA57.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe"C:\Users\Admin\AppData\Local\Temp\2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe"4⤵
- Executes dropped EXE
PID:904
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4604
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4360
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5cd74a661390a025788bb8d581b8997fe
SHA10d8b0ad53ffba3d0ee68e2fb75b20a0cdd46fa79
SHA2565072864ce1a620293be18521b1b13c9c1d0677578c14578e9a097f67d30224a3
SHA51261ae0a82f4e839911d547a2b653d657c143f9d3529206d68bf84492320261c621d936a6b2fa97946e4d56a3c0f91380d4a1ee7c6fa66ad297fdf104d4623dc90
-
Filesize
577KB
MD5c646d99cc49f1d66be90cf4b78a2ada2
SHA198096072883c22562359ee8fc602e4028dd1095e
SHA256c93aba49a86b7af2659a7cf20033f05e469caf6eb699c385662cafe93f03b64e
SHA512a591e68a4adea138da4c79d012e1c6a32defbfb079d16ce02c7de5ba42ac2a2b312d082a493856ea3981ab3d3ee72235c8b2cded3b5c3803c257d24061e4a8c7
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD50eec0543603f7a8ce8e8f5fee478e1d2
SHA1f975d2b0358d8f138bdbaa04e433d85297f29c2f
SHA256636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
SHA512cbcd9919c79180c43d588c27107dd04c04378da47df03cb27f072ee296e9c23a7690e3196b457dda14bcac96a38617f597c83a47a813a58c813f3affbd6a2a05
-
Filesize
722B
MD5bbd3ccb342d5bd872248903d801af983
SHA1ceacf7d619d3d0814563fccd0b931677e6f07a4b
SHA256665775e0b16dc99372d53256c66c81e48880d1cbc7cb0648e55c98294d10a63b
SHA5127a43c6180a94e9f07139f6310c5281cdcecf5c055811b11c634189ba661086428d9b35b4d6b0126bdf4891095f85c6c07eb87d3636586fce835c9ccdc71ea96d
-
C:\Users\Admin\AppData\Local\Temp\2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893.exe.exe
Filesize108KB
MD5ef3bbd1c0aee0eee1f0b2f333d668c80
SHA134dd3f05d15664d647a41275f9b65b49a7b2aede
SHA2562656a366623a3bf591cfece748df4d57c2e5c1f968eb651af5f25e91c76f9be7
SHA512e6cb2eaf1ea857346625bf1ee765e177a5f364927915eacdd1175b445e9e32a2e29c89b0ae8fa34057dc50c9701081a3cfb32cbc3f702d367c6cf374a2b5a34c
-
Filesize
33KB
MD599171473455f287bf3271f2200d81338
SHA160a188feb436b02bf71167001ed8e553df610534
SHA25697ae3f5a8b3fb129735fcab7e9c48a1711224be57eacb83aaf7284bcb06b888c
SHA5124864ebdf3a8f5f51c5f9cdfd5ac3ea64cb2c7852c62dbfc3375632192ec15dfe3979d2225ceb05a4098539e4023c3f8c8550745164a4d28a850e23ea6e63d41b
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD58f7e93ddb13ba90485e607a464d90e13
SHA1cf8017b3bf7648edfeb3ebabc6ec30e0a588bff0
SHA256adaafb82143154ec0c4f4a9ec25824de92a30b708876cc276fae77a83f161ca8
SHA51256ccb7556b9c2563f254f947d63d72d05ffbf7cfaec65ef3f0fb94ae6f95c708c8652002d88af13e5ac35cde6ebb8f2834572392b52a938a1c2e84a063306b78