Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2025, 17:39

General

  • Target

    3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995.exe

  • Size

    47KB

  • MD5

    6ae65a94faf6f1c881b3490d0d8d14cc

  • SHA1

    e35919130e46d91e42089f78f162798b440c6b62

  • SHA256

    3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995

  • SHA512

    51225f855dbaee137ee6a950bf5296a6a5bcd3aff16c61fd53b1a71b9e9ff71e37b81401f6fc0e0166b523d54af053f41b44f2a04c17e89b0248c063354956ec

  • SSDEEP

    768:u4pQFJFKZj1PVs9Ag1vzu4OQZcymnKY1nJbz37gWQ3655Kv1X/qY1MSd:u9cx1aeg1v9OQZXMr1np30HqaNrFd

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3348
      • C:\Users\Admin\AppData\Local\Temp\3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995.exe
        "C:\Users\Admin\AppData\Local\Temp\3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1300
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3920
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9366.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Users\Admin\AppData\Local\Temp\3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995.exe
            "C:\Users\Admin\AppData\Local\Temp\3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4480
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:228
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3296
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4744
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4788
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2244

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe

            Filesize

            132KB

            MD5

            0577dd8cde667a4f05db075e716e6062

            SHA1

            f52e60019beaab69b4b4553a4f483aa322e7cc53

            SHA256

            cfcc4ab9a6c2f6a2788cb5fd5c8835d0d1f68158c8f88d0971978f003b2a9527

            SHA512

            c340f533ab80aa46cf16d0bff23d3e50316660498bd5ad434db8da0f196475c41bbf24722d778381ed54ff503c640d32c2d7a92f76c19dfe202387574ee40557

          • C:\Program Files\7-Zip\7z.exe

            Filesize

            582KB

            MD5

            2a49632e21655718915b368e482092c2

            SHA1

            51434359874aa23ca1c3eba3a546649a85cfdecf

            SHA256

            9452a34120ab9dfb06c6dcc46a5ab8e1411629cda354adb8ea9b65d29cbdb599

            SHA512

            a0427d682dab7eed9d57f726e74af23ea9a76950dda0dc36d3659b0320da955e7461f2318b5c029092040710d157876cfc70aa9c554d53376d9cb20c3569c006

          • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe

            Filesize

            488KB

            MD5

            5ede147d684b624bff3c9087fc2f203f

            SHA1

            174c4ecba8d016bf2de19a1909479a08fc14de2b

            SHA256

            130a8a4abffa329e7253daa17685da1ca5eb705fd517766f88a7af704f6d71e1

            SHA512

            f605e21a16fc48327250ba0aa871d0921127a62c65613faf089e5fface89ccaecb5ab23067961930e2179699b686f291bf2c86da9cce2709304bfd5d3429e76e

          • C:\Users\Admin\AppData\Local\Temp\$$a9366.bat

            Filesize

            722B

            MD5

            e190fdadd3ad12a829b641735b4653f4

            SHA1

            5a11671f6f48f476594da0afe3875077a23d6913

            SHA256

            acbd46490673d64bc55574c41fd6da1550f08e5247fc531503e22140fc05ba81

            SHA512

            302d9b85761a00d1cae78d5e3c8dee78bd433d65bbecd418d78fdde0b8595e13f19e91d00cf0794f373ab94709f1ef560fb8e6ee1e4218eaa24113e5053a042b

          • C:\Users\Admin\AppData\Local\Temp\3cf56afcc000e0c624d50e29c3e41ff99422b432ccdc821285175fc2bb8d3995.exe.exe

            Filesize

            14KB

            MD5

            ad782ffac62e14e2269bf1379bccbaae

            SHA1

            9539773b550e902a35764574a2be2d05bc0d8afc

            SHA256

            1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

            SHA512

            a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            8fecbc803dfea6b969c19617467a0818

            SHA1

            d71e19cc1fae6e958c2fcc279bba5b0364dbaaa9

            SHA256

            d72c764dbc7890c0874880ed3c7a09193d2d721e84922f13dbb4f4da7cf5636f

            SHA512

            4a8d038dc24af4b3ee411482caf3b56e6768e6e02e99224b1101e7adacbf08cdca9cbaf469fd9e25569a41a9df38a174de080f1bf5892a0d9900ee62033e0971

          • F:\$RECYCLE.BIN\S-1-5-21-3008489981-1977616533-741913813-1000\_desktop.ini

            Filesize

            9B

            MD5

            8d5d367ed8a2afc1fc0b8fc7d14da98c

            SHA1

            fddfad39cd8b448d0d3dbb6e9c67752999568783

            SHA256

            93740c0db50f557803e16032194380e92e586f9cd845c4543eae2c3aa97d95f6

            SHA512

            3215518f650fe697fa80054e2e7e98a55a23832309347704985d502ecf46726048291ace0a619b669726fda404c9235047a21563971a238864ee3523f5bbe96b

          • memory/228-1629-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/228-18-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/228-8-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/228-9581-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/228-9712-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/1080-0-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/1080-11-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB