Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe
- Size 496KB
- Sample260425-lp49rad19x
- SHA256 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd
- MD5 79ec08400e269a32a96c8b976edb0283
- SHA1 9483ba5968c371704a92cd2589b68db7e9920865
- SHA512 b36f55d588be438f3738b2ad747cb8b03585ab687f154ebcaf5e8bffb2eb2bfc496f58b8b152d09fb8581d1ee0f776bf3d1c908d5d0153041b070ee0dca3047d
- SSDEEP 6144:Lj9c9AWdC+v3cpQvYJvKPSwv2nPEuJ1fHbIop44Sm5FpxyN90vEbsN7:LjiEpQQJvKPSwvY1fHTHy90w67
- TLSH T10EB48C16BBD4C039D5A20630B86EA76692FEFD707574820BB7D0779A1C71A82DB30B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1848 Logo1_.exe 4276 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Licenses16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe File created C:\Windows\Logo1_.exe 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe - Program crash 2 IoCs
pid pid_target Process procid_target 1692 1848 WerFault.exe 81 4960 1848 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe 1848 Logo1_.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4636 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 80 PID 3352 wrote to memory of 1848 3352 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 81 PID 4636 wrote to memory of 4276 4636 cmd.exe 83 PID 1848 wrote to memory of 2248 1848 Logo1_.exe 84 PID 2248 wrote to memory of 4592 2248 net.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17E8.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4592
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 8443⤵
- Program crash
PID:1692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 8443⤵
- Program crash
PID:4960
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1848 -ip 18481⤵PID:1032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1848 -ip 18481⤵PID:4548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.1MB
- SHA256 a7da3b87b25fa0907b8ec74d7d9870faf45038f94f16e06383f16ad2eea87b7f
- MD5 bf9174a876561390cce0291944ebcbfc
- SHA1 70195b67604b49ed92e11da66ca10e1c5405b363
- SHA512 5a4185d7625f483726e22d7f4420321a503506f3f3a5a7da39b16c2476d638f8576d54faf265b4b841b9af2c1f0c86fd0b0b9f6e4a4cc5c2bd1527431834feb3
- SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd23UQ:7QRQyi36YOcP+Lvw2gAf+PN34
- TLSH T1F0566B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a17E8.bat
- Size 722B
- SHA256 93436967dbb2f808ac836f9ae926a9a2824696a432ad9dc924d84219949f1cce
- MD5 d71b9a1e61f287835874d3ec94daef5c
- SHA1 272f7c0aeb1b043ae4d30215eca8a8132cea5a6e
- SHA512 d9a0b963599f4c478204ea07414680a4b3d36b988adb55e15cb6c69e9b4dc3e484db6fba6edb824698761472ad556089d544f914213ce46c64a2ffa7492ee531
- TLSH T19101448881B957AE1E44D0730F9858CFC4632E4B3BAF7A36A7709A7818DDA1FD3D5141
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe.exe
- Size 452KB
- SHA256 e69c4abcc4d2f130e66560fc27829b4fe62a2b1f66933790a3060bd7f4fcd878
- MD5 95b8a4245a6cd37d36e56fae5a23e2b1
- SHA1 139e0223e64a2d4f7ae94e347c657bdb86dfd5ff
- SHA512 9114af555b9d97c87834982c80d9a4a7cc97b8678ed55d96a1a02999b551e9e018d376b404d0925bbb87dcd2aa8e0fa8bf7745f60096a7df01cd918002fb0bf1
- SSDEEP 6144:bWdC+v3cpQvYJvKPSwv2nPEuJ1fHbIop44Sm5FpxyN90vEbsN7:aEpQQJvKPSwvY1fHTHy90w67
- TLSH T16CA48C16B7D4C039D6A30630B8ADA76692FEFD706574420BB7D07B9A2C71982DB30B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 44KB
- SHA256 af695904422ca5d4364d45955082db74f12efffa36b583458bd1bb866e1b3dcb
- MD5 3dde3b7ee3d05628fd88a2fc9c1abeed
- SHA1 fe1f8bf294385460071553167fdcc96c1a462084
- SHA512 a8f37a714db80d546a7fbe72768125686c224c54743e628502c0591f9595eda7036a3eb9ad57e335966464df1b2c73fcc45324eddc84749262e7a0291260bfea
- SSDEEP 768:ZmpT2ljlL5b+nXLpXwnslmxtOsoI8A+bbHj3eVoKt/pIxDdct5l0m/gJX:ZmKj95b+nKbIs78xHC/payND4X
- TLSH T1CC13D01B3F4E6574E69698744A2B1FB58B387CF2FE12D204C3B055AEDCE5358FA02941
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
- Size 9B
- SHA256 49ae628b21eceb52cfae7af66d488c736e334e8e5a05bacaac62b3ddd791251b
- MD5 acdb534d0253a176a2a0e1fd11e837b9
- SHA1 a527b792940d294bca3c2fcec3cc01f48de60689
- SHA512 ae6fee904c215193b2a84e2af6e46875b5c4ede55ec8a53eb88fc6204a207329b7b4e140e16c0630b3df64395b8533c4773e1a2157b654962d7c1390dc8097fe
- MD5 SHA1 SHA512