Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
- Size 449KB
- Sample261027-e66qkscf73
- SHA256 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6
- MD5 ed26d5eff61b778faec5610cbb852455
- SHA1 d6ca67d328294aa02263bb748811b2c4d418f921
- SHA512 5e8874828286660216f59e8de4dc52afd0b0a478b4946c8846bc2c408d59a8402aec62d38f62d581b90ecb26329cd08a3b2a8a65f135bc42b9a317aa9f6bfad8
- SSDEEP 12288:K7+U46jJ+OVQmLztrMMMM6MMMM7MMMID/:K7p/trMMMM6MMMM7MMMID/
- TLSH T18FA45A1077EA9008D4F506729C73C5905B79FE662980CA4E39D8721F1FB27E28B6376B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4904 Logo1_.exe 2528 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\MEIPreload\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe File created C:\Windows\Logo1_.exe 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5716 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe 4904 Logo1_.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3536 wrote to memory of 5716 3536 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe 90 PID 3536 wrote to memory of 4904 3536 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe 91 PID 4904 wrote to memory of 6028 4904 Logo1_.exe 93 PID 6028 wrote to memory of 2392 6028 net.exe 95 PID 5716 wrote to memory of 2528 5716 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe"C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5191.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe"C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe"3⤵
- Executes dropped EXE
PID:2528
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2392
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
- Size 228KB
- SHA256 9a042688507e03775ba22266f1994a68ebe4de2e4a64010d58484130927a2d2d
- MD5 0d41a06f7d437b66a43405056c171fcb
- SHA1 1e4537b70e37fa1768b1a67c39992efd412e3e75
- SHA512 3f788a58adc563d34e326c6c95b5d47b6a9d2f96a722188dfb3ff3b1f572c99b8a96dbcb5a229b1ee184a24a87734bf87f40f80881f252e710e69dcd2c47c6d6
- SSDEEP 3072:oftffjmNoxa/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9P6:4VfjmN5rZl/DFf3WC3as7B+WCR
- TLSH T1F534811233F85929F8F39E316C398F2AD93ABC31AE34E66E1644119D1C35A51AD31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
- Size 660KB
- SHA256 5f6c3a15c9358d4898cba695272af729888b23e0ee5a0f70a4c82cf6ec63cdbc
- MD5 9d7d9051e142da86fd85e778ce7121fe
- SHA1 9e94d9b92461363f9d6f8506c02e870587a33013
- SHA512 f12f6d7010f645dc48ce1b7d369f1beede2032d8f9eb183407db2c9bf36cc85eae884908f055e2ea4913ad52a404cc3cad77682599c3f5a2c23c6c1b8e3e361f
- SSDEEP 12288:Bp7+wnMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:H77MysZgjS1hqgSC/izJfojymk4HM5yJ
- TLSH T1D9E49E3294614036E6F106B3B918A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5191.bat
- Size 722B
- SHA256 08f7ff3c30746335758832afc7a9e6759a3946e827bde0005089b83b42531178
- MD5 2e26f5b1bceda326c0fa3acfb95d5743
- SHA1 a688b35a9d31bdb1f7f3b85a58acf4cab5820dd8
- SHA512 f952be6952d78ba27069cec851f55156ac4c6c9d677b560ed44f602018e22fd469bd57f9e7fb931b00ab800414a1c9dfeda8d99821fe52d7b79e8711c0c3879a
- TLSH T16001A2448BC99A1D8E0AB03F2A71C4DED4613A4A3F997E1661578F8848C300DBEEE345
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe.exe
- Size 423KB
- SHA256 ea2509dbc993b75e2c66e4ab20716a27f7561591d952c4ea403a64a7f0cec07f
- MD5 17824b5457e9d4519d1a6a1f58e109b4
- SHA1 26d8fa49a5800c8205736127bed678c76a12012e
- SHA512 71d2b0e5db1ab47ecc1782b3c6c34df4bf517bc2c4bb4936b67a92f89788e7a0fc4a084097a918f06eca3b1f8467877848d356eec7dc586940347787e7ef35ac
- SSDEEP 6144:Dnx26mWJ+OZgudUJKyBStQ4Xtb9SzcTtrMMMM6MMMM7MMM96oM9+UfJnZNt:D46jJ+OVQmLztrMMMM6MMMM7MMMID/
- TLSH T1E2946B1077EA8008D4F506729C77C5905B79FE662980CA4E39D8721F1FB27E28B6376B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 26KB
- SHA256 fffa8d49ec12ac2d0e39b6476243891dc9f12e92e15f435f94cb860ee87376ad
- MD5 d81e2c487cc0d53893cce2852430de76
- SHA1 729ce409f531a0e67f9a1cebe4a33e146cf11cd7
- SHA512 7639d5b6d71ca37831df521776648c28969eeaafc422b9e73a3b9d019046cd6db868f5f6e18684e5461eee60cb5285b8101a79f0a39ee0826b4dc612b5728058
- SSDEEP 768:G1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:gfgLdQAQfcfymNG+Kx
- TLSH T174C2D06912E87739FC1B4ABCDFD75B01826C0BBA116E56292CF1C87E0560BB9100EE93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\_desktop.ini
- Size 10B
- SHA256 429d13db37d4bb1357cb28a091ed6f6ce018fbc952452c34f11de1e40dcb3a59
- MD5 110a11ae4d7bb9a6e9c5c9e2c8fcde6c
- SHA1 c6ec8483b3628cdea8519f90023429191a4d8918
- SHA512 514a94c9c2f76cbb621a856fd2f69e39dac4e977d1c95762eebfae279cabdf021bce4d87f48fa69e4a420106b1fd9440f18887159004df843aed26bfc6c2f41f
- MD5 SHA1 SHA512