17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7

Analysis

max time kernel
81s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
Size 48KB
Sample260529-csapwabs7t
SHA256 17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7
MD5 ead9afa559e691f9d57f0ae6f284ff70
SHA1 46bc03fc99a1df467e4c34fbd3c78f852dbc508e
SHA512 098ebc27c73fa3c5a54afadf977301bb41f99519ae716e710c5f0af6ec3b6e752a8e549376cad149ccdc1b2424df884455d5a7fa16ba2457b6d9390e4786e5d9
SSDEEP 768:6O1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLasNWbeEK8DofmwYijbAMxkE2:tfgLdQAQfcfymN3sbHofmw7jbxK
TLSH
T19D23D06348E40C21EE464D78F5F24626CF7D2F671D9B82E773B682258B90344718F6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4040	Logo1_.exe
4352	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Crashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Crashpad\reports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
File created	C:\Windows\Logo1_.exe	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe
4040	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3096	648	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe	82
PID 648 wrote to memory of 4040	648	17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe	83
PID 4040 wrote to memory of 1044	4040	Logo1_.exe	85
PID 1044 wrote to memory of 868	1044	net.exe	87
PID 3096 wrote to memory of 4352	3096	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
"C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8325.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
    "C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe"
    3⤵
    - Executes dropped EXE
    PID:4352
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 a31388711b4c90d16bde4b30a08357a7b74ed9cee6741ff3dba2dc3da217a5a0
MD5 95e0b25439be0c4a2f1b2b0479cf2119
SHA1 a11cb1e49ec5d0adcb02ade9fbdfaa77f93dd6cc
SHA512 65444392a1d08ae858683398ca6e6aea61ce5d1660336259333a2ae519ebbd65041f4549471e1147d1c4507d12406b650b13ab2cbcc9240a0c40f002aacbac4d
SSDEEP 3072:GftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:+VfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T112C39D1375D08472E4B2593109A1EE718A3EFD620950DEAB33D51B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitInstall.exe

Path C:\Program Files\WaitInstall.exe
Size 541KB
SHA256 fa0be712768ade116bdf3c5b13f949c3a95aa7ad3dfb1472a8ee4db59202a1cd
MD5 011e30a1af4889bdfe5a49a1044d3240
SHA1 3121fdd962e78943e07f6ed98b688ec775bf3456
SHA512 365d4ba5cbbd05f0aec64996eaaa405fe4eafd63fbc18dccfd841f5005000067ad1663b3645444005337c03cf5808f6d25de0e5396a043c417c495987cafcd56
SSDEEP 12288:b7+UFznHG1uGbb5vAmEistWi8pvmil4xzn4uZ7dX4okDMQcTqY30/CZU:b7nFLmQPmLs6pN+xX4T63NZU
TLSH
T191C42316CF784DC6CFB395378CA98AC5A616DFA1A0F3A45413B0C81D35F95B81883D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 190KB
SHA256 b7763fcad8aea5560eb2356e7267576f509d63e397e007f5be110b27e0c7acc5
MD5 73007f18ff64df393f0c25d75965b685
SHA1 13faf475df6774d1ee6b657b9b83a25fd4183024
SHA512 65e2c784208ae0969e36d20b883e1dd841344737161d295667373cca86fc896bd6844e9a4cb7d7d7b4f3f26776d3d7dddf904dd36162fe01ad29685ac067e2f8
SSDEEP 3072:PDftffjmNZqiMPW6FIvu2gHfm0FR/xSXDxZMq5SEHUdlGmE+Cn6YZ+C5hB9Xszd0:PTVfjmNZqIuRebMq5S+Ud8AK+ehB9XgK
TLSH
T19A149D22B9D19027D79112B39D0F6B64B6B893142E21DC9B5744ED237BB88D39F7320B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a8325.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8325.bat
Size 722B
SHA256 fdf2bf63371ff7916b3f32593e4f5660122803fef72363b231cb28b28e2549b9
MD5 773088d621c7dd42891e0c674a6bf204
SHA1 cc5b0b3bbe441bee776479e5d0357f70bf9043aa
SHA512 389918843aa20975a658c3080aa94fc3ffc8511fe22a082cf2d51111cdc249dcd2def0518bab196d6c1fc1a7792721a76d0cb17e62315109b64aeba8ac42d332
TLSH
T1B901295681A3C3FD692291DF0F68A94EC033382B3FC673E5499D4409229D42EB9D3746
MD5 SHA1 SHA512 TLSH

Submit Download

17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe

Path C:\Users\Admin\AppData\Local\Temp\17476dc4d3cb7b99112fecce2af8d8c9da99a808885bcc8c9ffb655282d3aed7.exe
Size 22KB
SHA256 e89996df86dcb600b539a9f35531150781f0a068a5a0c5902c304f347e5f612d
MD5 e716239438fc99cc6740c8f49f4a064a
SHA1 725684bfc695c7d88f1806a26ab861cff6ac2025
SHA512 b3b96a20e4f71cc498df6b6c5545670c75b19a38a3f6671a15fe493f95d6f69fece957b9df7650e7f98d8ba4c0cb7640c9affe689edb333e12a1ab77d0d07bf2
SSDEEP 384:KsNWbeEJ4rLJaNjjFA82URXefmOmIYi1oMtbAM+o/8E9VF0Ny/q2s:KsNWbeEK8DofmwYijbAMxkE2
TLSH
T166A27C53C8A50C02EF474E7170F14A6BCE7D7F632E91C2DBB36A82108BA5345B6961F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 26KB
SHA256 e03b1385cb498b0f55e4f39f3b14c0500fe501d9d6dbc69fb7388c462fc89b31
MD5 4f09471125ddec438312ab7485a32aed
SHA1 3602061366bb5f8774f7f2cb358cf197929da16d
SHA512 b1e936451bdf7d28e1ba702c58ff0174cff2be1068f28f699dbfabf8e9df37aaefaf81ce576b94c1f86885012e14a4af21223197f7452dd9eec240c0f9898c1b
SSDEEP 768:6O1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:tfgLdQAQfcfymN
TLSH
T1F7C2F1B615C81A35D869097CDFE35301C3BE077E44AF64A625F18E3F2691AAD200FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-889581200-2041691093-2048517887-1000\_desktop.ini
Size 9B
SHA256 b6d05bab5deff5ec4bb3fbcbfede28f076ab9a016c5317e73834a87f510ac73e
MD5 830e1c4fc5bb06ec6a11c4236e71c757
SHA1 6a39cb2b680d0413f27ca078bce52949ac73c596
SHA512 acee0897eac9188345de0dd3b736fa0a78766145387d2dbf3820180db064f78b6cdd0bf4209c603af939539d39e0fbe7987970c7583f6ec98fc577f56d5c1b07
MD5 SHA1 SHA512

Submit Download

memory/648-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/648-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-5036-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4040-5541-0x0000000000400000-0x0000000000434000-memory.dmp

Download