Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 16:14
Static task
static1
1 signatures
General
-
Target
dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe
-
Size
394KB
-
MD5
20bfb4b7ee016171a3b9c346604b78e2
-
SHA1
b930d2ee4c37fda2fae1d41029770ed928b5c5bf
-
SHA256
dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953
-
SHA512
c83f1e06e81730e0cb55266e9a8c7522f4199ef2df26d3a12d5041ff69c691f847db95982d7b6ce77a82ee537830d6c00d726811bac21d7e778ab6e2d6de1ab3
-
SSDEEP
6144:T46tGdye412P2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuz:T3NbZahVy41
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3728 Logo1_.exe 2500 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe File created C:\Windows\Logo1_.exe dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe 3728 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4792 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 87 PID 2784 wrote to memory of 4792 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 87 PID 2784 wrote to memory of 4792 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 87 PID 4792 wrote to memory of 2812 4792 net.exe 90 PID 4792 wrote to memory of 2812 4792 net.exe 90 PID 4792 wrote to memory of 2812 4792 net.exe 90 PID 2784 wrote to memory of 3684 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 94 PID 2784 wrote to memory of 3684 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 94 PID 2784 wrote to memory of 3684 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 94 PID 2784 wrote to memory of 3728 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 95 PID 2784 wrote to memory of 3728 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 95 PID 2784 wrote to memory of 3728 2784 dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe 95 PID 3728 wrote to memory of 2920 3728 Logo1_.exe 97 PID 3728 wrote to memory of 2920 3728 Logo1_.exe 97 PID 3728 wrote to memory of 2920 3728 Logo1_.exe 97 PID 2920 wrote to memory of 5032 2920 net.exe 99 PID 2920 wrote to memory of 5032 2920 net.exe 99 PID 2920 wrote to memory of 5032 2920 net.exe 99 PID 3684 wrote to memory of 2500 3684 cmd.exe 100 PID 3684 wrote to memory of 2500 3684 cmd.exe 100 PID 3728 wrote to memory of 1292 3728 Logo1_.exe 101 PID 3728 wrote to memory of 1292 3728 Logo1_.exe 101 PID 3728 wrote to memory of 1292 3728 Logo1_.exe 101 PID 1292 wrote to memory of 3164 1292 net.exe 103 PID 1292 wrote to memory of 3164 1292 net.exe 103 PID 1292 wrote to memory of 3164 1292 net.exe 103 PID 3728 wrote to memory of 3500 3728 Logo1_.exe 56 PID 3728 wrote to memory of 3500 3728 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe"C:\Users\Admin\AppData\Local\Temp\dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F54.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe"C:\Users\Admin\AppData\Local\Temp\dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe"4⤵
- Executes dropped EXE
PID:2500
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5032
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3164
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5dc01a6ab4cf6e84d10d802d41c268220
SHA13b45ebeb7158cf667b125efbd2e417071bb2819d
SHA256024c028dcc86ae283878cfe848b86f5539d1c14ebc9f3ef9ee46510c4a30e407
SHA512a7d6f1120067ba5fc44d3fb57dc42f93cb6c08310c3dd3a11fdc42b01dd2931168e0dd0a42f6b8e4b55f6300ce28aae2a96e9d6ebf1498aff56ac305f4fc554d
-
Filesize
582KB
MD5f610140e8045de75c009b0817ec73c97
SHA1c6d4da7f61f9f37c2e136a2c21b3f875c8cbe74e
SHA256a2bdb669d734dd9b58c8012f459bc49e1aa9a539b6adc11d8ad1e31a3ca594b6
SHA5127c634b39c6be95ec8be5861e6cc53cd9e32137b8588da259465f8acf2f7c6c90f475ac143b23ba3c2c27ee7a8265c02485d5dd42ca5b5d94a3cf2bd3240547da
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5aa1f66c378cbdbcb7882e245c07b9def
SHA1e50b4c0b495f97317f96ae0c42ca452b504e3970
SHA2561aa4de231335138bca74aa29fdf52f58adbe09b68e8d717e6549a0ad400c6f8f
SHA5129894d2bae12941be81164f3d00f9d90b69b421f9dbbd4436937ef667783a70d70c640e3fd5e7855bcb9e9ece0e04d2866140692dadffc19a3de1e8bf661ed9ed
-
Filesize
722B
MD5d765fcc159029e94ed7fcbfafe905b14
SHA17cd60c16078e25b201b50c4c7ea7027efc980e98
SHA256b196842cf62aef3d8c1300b87dc967805bceb64c70a21395af1553dca664be8f
SHA512de979d8a7f9851d832fd5988b2b2846ca05b3bc3721726153980187cc92f65705ac0eb1512b3ee0e6c8c842946e6bce0007058a75d7e2527a7637408d32d9002
-
C:\Users\Admin\AppData\Local\Temp\dadb194dc57938df164801a69b7f74656c17cf55b9a070b3491fb0dca1e85953.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
33KB
MD51aeb31ee1d951ea2e78a19f5b23cd7e4
SHA13dd09718e9e4bcc2a03d11456815d56b4e2587c4
SHA256537daec8665ada5375e0c87619d5d0992bfe0e7d9c976702554e20ae857eb6f9
SHA51206cbed6a3557d9f57d0e2e4ace95ff43501dc8a83262db49ce6d4feba98026c5453432048ba3bb55a4c339479d34384c3081d0e2b27daa09a00be0226daed2a1
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
8B
MD5b7ec1da49148e97bf44f32e8f6d562b0
SHA1957456b7a1d8c1f9b7bdfb5105d0d92005e74159
SHA256aba4a691666b271da9aa9ccb8261bb6c7bbf763942555ff56423e46e00d032bb
SHA51230cd415a858163446330517079193e6c9a50f5dd1b08b4536546e508a0f40c7f9da83649a4dd6579b714d27f797ba075fd043be31e6ee6fd44c51a479fb710ae