d394b573fb3b8a4d3a61e0c2112f34d4604f18f846821fd0170035e5b9439e02

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Au_.exe
Size

481KB
MD5

dfcf382bd0dae49948a20f706a903eaf
SHA1

4adf111c4eb676b011a6ce362c4b1bf82af533ad
SHA256

d394b573fb3b8a4d3a61e0c2112f34d4604f18f846821fd0170035e5b9439e02
SHA512

b818b677197fe8bba30a73e0386480dc2abbc2151a8d2030d0beb2eb6c2ecb36d767ea13f10fffda5bc1787e8e4e4fa9ce51d83b7490df6390ec5521eb2c8f60
SSDEEP

6144:o8dNXSElwE9pi8h/C/LlraLaaWDLhVauaaaAZ8aaaxaaaaaahaaaaaaaahaaaaaT:blwE9SHlGN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1420	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
1324	Au_.exe
1420	Au_.exe
1420	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x000b0000000122f9-55.dat	nsis_installer_1
behavioral1/files/0x000b0000000122f9-55.dat	nsis_installer_2
behavioral1/files/0x000b0000000122f9-57.dat	nsis_installer_1
behavioral1/files/0x000b0000000122f9-57.dat	nsis_installer_2
behavioral1/files/0x000b0000000122f9-59.dat	nsis_installer_1
behavioral1/files/0x000b0000000122f9-59.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe
1420	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1420	1324	Au_.exe	27
PID 1324 wrote to memory of 1420	1324	Au_.exe	27
PID 1324 wrote to memory of 1420	1324	Au_.exe	27
PID 1324 wrote to memory of 1420	1324	Au_.exe	27

C:\Users\Admin\AppData\Local\Temp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\Au_.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
481KB

MD5
dfcf382bd0dae49948a20f706a903eaf

SHA1
4adf111c4eb676b011a6ce362c4b1bf82af533ad

SHA256
d394b573fb3b8a4d3a61e0c2112f34d4604f18f846821fd0170035e5b9439e02

SHA512
b818b677197fe8bba30a73e0386480dc2abbc2151a8d2030d0beb2eb6c2ecb36d767ea13f10fffda5bc1787e8e4e4fa9ce51d83b7490df6390ec5521eb2c8f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
481KB

MD5
dfcf382bd0dae49948a20f706a903eaf

SHA1
4adf111c4eb676b011a6ce362c4b1bf82af533ad

SHA256
d394b573fb3b8a4d3a61e0c2112f34d4604f18f846821fd0170035e5b9439e02

SHA512
b818b677197fe8bba30a73e0386480dc2abbc2151a8d2030d0beb2eb6c2ecb36d767ea13f10fffda5bc1787e8e4e4fa9ce51d83b7490df6390ec5521eb2c8f60

Download Submit
\Users\Admin\AppData\Local\Temp\nst11CE.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
\Users\Admin\AppData\Local\Temp\nst11CE.tmp\nsProcess.dll

Filesize
4KB

MD5
faa7f034b38e729a983965c04cc70fc1

SHA1
df8bda55b498976ea47d25d8a77539b049dab55e

SHA256
579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

SHA512
7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
481KB

MD5
dfcf382bd0dae49948a20f706a903eaf

SHA1
4adf111c4eb676b011a6ce362c4b1bf82af533ad

SHA256
d394b573fb3b8a4d3a61e0c2112f34d4604f18f846821fd0170035e5b9439e02

SHA512
b818b677197fe8bba30a73e0386480dc2abbc2151a8d2030d0beb2eb6c2ecb36d767ea13f10fffda5bc1787e8e4e4fa9ce51d83b7490df6390ec5521eb2c8f60

Download Submit
memory/1324-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download