ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15

Analysis

max time kernel
150s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
02/07/2025, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
Size 577KB
Sample250702-dgfx7askw2
SHA256 ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15
MD5 c79d936e59bcad076cc57ff14a74d85d
SHA1 a20b787d8c61a874eca2533028f621117741b373
SHA512 9a52e0db4fc52aec79c11db0543f57998bf7fbdb6900ad3e6515c47fed8bf5bd5683e1ea0d964b17dbcc63aeb381ff2bf84adf53eaf85a149a6565041b62cb0e
SSDEEP 12288:l+a9gxh7a3iwbihym2g7XO3LWUQfh4Co:lB9g6+gkE2fh4Co
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
432	Logo1_.exe
1160	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
File created	C:\Windows\Logo1_.exe	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe
432	Logo1_.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4564	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	79
PID 4164 wrote to memory of 4564	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	79
PID 4164 wrote to memory of 4564	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	79
PID 4564 wrote to memory of 3344	4564	net.exe	81
PID 4564 wrote to memory of 3344	4564	net.exe	81
PID 4564 wrote to memory of 3344	4564	net.exe	81
PID 4164 wrote to memory of 1456	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	82
PID 4164 wrote to memory of 1456	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	82
PID 4164 wrote to memory of 1456	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	82
PID 4164 wrote to memory of 432	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	83
PID 4164 wrote to memory of 432	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	83
PID 4164 wrote to memory of 432	4164	ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe	83
PID 432 wrote to memory of 4888	432	Logo1_.exe	85
PID 432 wrote to memory of 4888	432	Logo1_.exe	85
PID 432 wrote to memory of 4888	432	Logo1_.exe	85
PID 1456 wrote to memory of 1160	1456	cmd.exe	87
PID 1456 wrote to memory of 1160	1456	cmd.exe	87
PID 4888 wrote to memory of 2868	4888	net.exe	88
PID 4888 wrote to memory of 2868	4888	net.exe	88
PID 4888 wrote to memory of 2868	4888	net.exe	88
PID 432 wrote to memory of 4192	432	Logo1_.exe	89
PID 432 wrote to memory of 4192	432	Logo1_.exe	89
PID 432 wrote to memory of 4192	432	Logo1_.exe	89
PID 4192 wrote to memory of 4516	4192	net.exe	91
PID 4192 wrote to memory of 4516	4192	net.exe	91
PID 4192 wrote to memory of 4516	4192	net.exe	91
PID 432 wrote to memory of 3152	432	Logo1_.exe	52
PID 432 wrote to memory of 3152	432	Logo1_.exe	52

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3152
- C:\Users\Admin\AppData\Local\Temp\ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
  "C:\Users\Admin\AppData\Local\Temp\ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AAE.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe
      "C:\Users\Admin\AppData\Local\Temp\ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe"
      4⤵
      Executes dropped EXE
      PID:1160
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 131KB
SHA256 2fd7c160e6c3d01cc0813b2ea658f2c14fc45b1255d176a30ba7c9f3afa5ca08
MD5 7689fabaf86782c1fb7b4f2537dc06ef
SHA1 1008cfef93b4ecf8486c5e5884356c7f0131b8ea
SHA512 13579585168f5304de37509c1a8ba4196f1b7ece4d361865f7a52be3612a299ace9ea5c2ae5198f29624d2b0d37e80234c1c5b4908b2c65206628cdf19633773
SSDEEP 3072:4Nude+aX3tM6gT9ojYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:RA+aX3u6gT9ojYCk3ET+Tu3fCUzB+JHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

InitializeConnect.exe

Path C:\Program Files\InitializeConnect.exe
Size 219KB
SHA256 fa317595421e0e6b84927a85b78f84dbab9333a3d527ee296e7627c65f953e1d
MD5 ba7f68fc704b31a6eefbebca903ecad9
SHA1 c0dd5972d01444daed53e401ce6d5d185b2ac1a4
SHA512 c73063d98aaa7ef1b723522b6bcd17d819c9e3e10c01f96d3365d09aa4b3fe8d4a9effb960b857de117a94dd6d488dc8bf0d31817b18433b02a0eb78b0db599f
SSDEEP 6144:CA+aX3u6gT9o4TiksS0lHZmJQ7P4GNA8CeQ54nF4nJNjY1:l+a9gxfT3qDOQ7AGmeQU0j2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 488KB
SHA256 37f84ab2f6d38eb9cffb3784f7b82c88dbac82e380532253db91f3e9693de625
MD5 8ce05c5fb230ede7168c509da1334f00
SHA1 703d8d1852004cfcbfb502ace159224b0cdcd0b3
SHA512 4e09beae97f195c1e80864f43dfd44884b5cc5e71c89126dc2fcbc66e9d3f10eeb41a4b6019d2260bf53204626e4f2bb789c699afad65b2cc959084bc80f1e84
SSDEEP 12288:xl+a9gxxqIOkU8AMXE9B7PElZlP41N+4PUWfo:vB9gvBOkUhMXcBwc04nA
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a7AAE.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7AAE.bat
Size 722B
SHA256 4e455bb2a79d4ad3e274975863b9cc27ad13cc3556ca2958553d073f8d7256b7
MD5 ee73c539e0f6616681ce7f598e14e4d8
SHA1 04cf3090c2943580b27598c99715906d4b034d5c
SHA512 19a015a974fff098adec11010d9fb84aed0d7e9fbd299ef95b79688104bc35b758a9367674e74c0963d44fe41fe904aab344a94ed4a3e3f000936ba3f4057daa
MD5 SHA1 SHA512

Submit Download

ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ed36ac87b208409c50a856ca7878cd8703feaac45d27aca2374f17459b27ae15.exe.exe
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 33KB
SHA256 32959afe055bd209fcb03298b474b1cbc64f8b689d3ba9806547411289226a6c
MD5 42f7900f99846cc82c668ce29ab31802
SHA1 a6e6f15f27ec41e865a2d640884f4ec4d63e5603
SHA512 d98ca54286fa8ddf43c8fae9a7050f946060a309bee7ca6529605b68ed3aad78f59adc8e95d1a89cdd501b888c09d14e6f7bb9cbea8f24cfe1b1a4a08be07297
SSDEEP 768:45iudO5RroZJ767395uINsEKeMy/t3QTM/OFcxPS:4Aude+Zk77RNtMy/tgTM/OqxP
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-625765727-1271952295-745797415-1000\_desktop.ini
Size 8B
SHA256 7ee98acf971e32cae894381122352197a76e04e7689903e61cef63ad4f690736
MD5 5e50f2ec682db49e5e80b04589040bc9
SHA1 233cb585ea62e42d93795c6a681748643313fd2d
SHA512 a8d6e4cbdbd582807ede9532ab633f4679ec5675416101ce98f7b96a5ad78095e8b13b9cd280831beadbc5a6de5dc1358329ff0edb0ff6f2693771379047a6d0
MD5 SHA1 SHA512

Submit Download

memory/432-1652-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/432-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/432-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/432-9345-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/432-9711-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4164-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4164-10-0x0000000000400000-0x000000000043F000-memory.dmp

Download