36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61

Analysis

max time kernel
112s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61.exe
Size

659KB
MD5

3e7be76f29c24b8c2335227e59012882
SHA1

fc15731a06465033bb74200b9541d5851a815fdd
SHA256

36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61
SHA512

afdcf493905e1980bb8064416e74d7cfcaa72422e34c0229d5d19c66b56bc16613c9337081c92e161aca5ca6590c4bb8776b22a57e8c5997478040ad0e71601a
SSDEEP

12288:8saCmRylvwCooDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDz:bs/Lx+kqoU

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4012	Au_.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 8 IoCs

pid	Process
4012	Au_.exe
4012	Au_.exe
4012	Au_.exe
4012	Au_.exe
4012	Au_.exe
4012	Au_.exe
4012	Au_.exe
4012	Au_.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1948	sc.exe
2588	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0002000000022e63-133.dat	nsis_installer_1
behavioral2/files/0x0002000000022e63-133.dat	nsis_installer_2
behavioral2/files/0x0002000000022e63-134.dat	nsis_installer_1
behavioral2/files/0x0002000000022e63-134.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 4012	760	36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61.exe	82
PID 760 wrote to memory of 4012	760	36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61.exe	82
PID 760 wrote to memory of 4012	760	36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61.exe	82
PID 4012 wrote to memory of 2588	4012	Au_.exe	83
PID 4012 wrote to memory of 2588	4012	Au_.exe	83
PID 4012 wrote to memory of 2588	4012	Au_.exe	83
PID 4012 wrote to memory of 1948	4012	Au_.exe	85
PID 4012 wrote to memory of 1948	4012	Au_.exe	85
PID 4012 wrote to memory of 1948	4012	Au_.exe	85

C:\Users\Admin\AppData\Local\Temp\36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61.exe
"C:\Users\Admin\AppData\Local\Temp\36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc delete TenorShareService
    3⤵
    - Launches sc.exe
    PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc stop TenorShareService
    3⤵
    - Launches sc.exe
    PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\LangDLL.dll

Filesize
5KB

MD5
ebd0da54db9f12ffd15206cc24355793

SHA1
910be3bebdde55eb1ce05915a79f01ebdc622786

SHA256
4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6

SHA512
cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\LangDLL.dll

Filesize
5KB

MD5
ebd0da54db9f12ffd15206cc24355793

SHA1
910be3bebdde55eb1ce05915a79f01ebdc622786

SHA256
4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6

SHA512
cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\SoftwareLog.dll

Filesize
531KB

MD5
e7123ea0dab003f0ad63c65c2bac0fcf

SHA1
44f81958ac67fba5005578a4827a294acf2d04c8

SHA256
97fd25098853a263b8834af78f1fbe1bd9e2ab815304b9e20cf6b32bc11b176b

SHA512
b095b4b8e6535fe597987a5d43e71cbee95f65fde82c1147565e9c0f478b5ab06668df57bca39060633b17447b3176a24fd76a0d21750e159ea06d3bb7a97948

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\nsExec.dll

Filesize
6KB

MD5
c129bc26a26be6f5816a03520bb37833

SHA1
18100042155f948301701744b131c516bf26ddb8

SHA256
d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4

SHA512
dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\nsExec.dll

Filesize
6KB

MD5
c129bc26a26be6f5816a03520bb37833

SHA1
18100042155f948301701744b131c516bf26ddb8

SHA256
d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4

SHA512
dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\nsExec.dll

Filesize
6KB

MD5
c129bc26a26be6f5816a03520bb37833

SHA1
18100042155f948301701744b131c516bf26ddb8

SHA256
d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4

SHA512
dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuC7E9.tmp\nsExec.dll

Filesize
6KB

MD5
c129bc26a26be6f5816a03520bb37833

SHA1
18100042155f948301701744b131c516bf26ddb8

SHA256
d3694fa0503158194129d113fcc1c83177ff5a5f93d898ce0bcfe9ce12f06bf4

SHA512
dbe79859c41e00a6e951cee889e7f0de29a712792fb531662285a2d6e384884518c7d5d983894c185b3d31d81213d2477cf4576b0114d352b759fe07a1704e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
659KB

MD5
3e7be76f29c24b8c2335227e59012882

SHA1
fc15731a06465033bb74200b9541d5851a815fdd

SHA256
36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61

SHA512
afdcf493905e1980bb8064416e74d7cfcaa72422e34c0229d5d19c66b56bc16613c9337081c92e161aca5ca6590c4bb8776b22a57e8c5997478040ad0e71601a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
659KB

MD5
3e7be76f29c24b8c2335227e59012882

SHA1
fc15731a06465033bb74200b9541d5851a815fdd

SHA256
36b941030a351980814b5e31063e26e66acff034a872b33609e45d8cea892b61

SHA512
afdcf493905e1980bb8064416e74d7cfcaa72422e34c0229d5d19c66b56bc16613c9337081c92e161aca5ca6590c4bb8776b22a57e8c5997478040ad0e71601a

Download Submit
memory/4012-139-0x0000000074BD0000-0x0000000074C8A000-memory.dmp

Filesize
744KB

Download
memory/4012-146-0x0000000074BD0000-0x0000000074C8A000-memory.dmp

Filesize
744KB

Download
memory/4012-147-0x0000000074BD0000-0x0000000074C8A000-memory.dmp

Filesize
744KB

Download