31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-05-2023 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe
Size

529KB
MD5

0166d6c0688a753a3c1d2bb4230f520f
SHA1

8f2de698dd017204bc8bf85b4c28970362b60963
SHA256

31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380
SHA512

584d149cf2f614d6063957a9f5ed3a5e0c1730dec8475636991bffad6ae89adb5b94e4dc28df349dac8632f0de0365f80646e9c7a383541d2effe60d752739b9
SSDEEP

6144:AsKhNptElIBTT/wi6aTT8ntZ3yUHnY6MIshse:CtD62e6UHY0eN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2032	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
1124	31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe
2032	Au_.exe
2032	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000141f1-56.dat	nsis_installer_1
behavioral1/files/0x00070000000141f1-56.dat	nsis_installer_2
behavioral1/files/0x00070000000141f1-59.dat	nsis_installer_1
behavioral1/files/0x00070000000141f1-59.dat	nsis_installer_2
behavioral1/files/0x00070000000141f1-61.dat	nsis_installer_1
behavioral1/files/0x00070000000141f1-61.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2032	1124	31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe	28
PID 1124 wrote to memory of 2032	1124	31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe	28
PID 1124 wrote to memory of 2032	1124	31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe	28
PID 1124 wrote to memory of 2032	1124	31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe	28

C:\Users\Admin\AppData\Local\Temp\31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe
"C:\Users\Admin\AppData\Local\Temp\31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj1F95.tmp\DialogEx.dll

Filesize
22KB

MD5
65f7611fdfb132205ad1e457b98ca215

SHA1
e676b608a85aff2f5c97b23b07151a6d3524fc80

SHA256
5e758be17546ac2d3e63e465c1d14a55451bb3129c912fe752979812e48b4e66

SHA512
7dab7c8e154a033b7d407e0cc176310bf942a40cc22f58ebda7478101bfbf7261de428d66c3f4400ee4ce3798a97dcd6808f862825146fb0db545c82c7487916

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
529KB

MD5
0166d6c0688a753a3c1d2bb4230f520f

SHA1
8f2de698dd017204bc8bf85b4c28970362b60963

SHA256
31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380

SHA512
584d149cf2f614d6063957a9f5ed3a5e0c1730dec8475636991bffad6ae89adb5b94e4dc28df349dac8632f0de0365f80646e9c7a383541d2effe60d752739b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
529KB

MD5
0166d6c0688a753a3c1d2bb4230f520f

SHA1
8f2de698dd017204bc8bf85b4c28970362b60963

SHA256
31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380

SHA512
584d149cf2f614d6063957a9f5ed3a5e0c1730dec8475636991bffad6ae89adb5b94e4dc28df349dac8632f0de0365f80646e9c7a383541d2effe60d752739b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1F95.tmp\DialogEx.dll

Filesize
22KB

MD5
65f7611fdfb132205ad1e457b98ca215

SHA1
e676b608a85aff2f5c97b23b07151a6d3524fc80

SHA256
5e758be17546ac2d3e63e465c1d14a55451bb3129c912fe752979812e48b4e66

SHA512
7dab7c8e154a033b7d407e0cc176310bf942a40cc22f58ebda7478101bfbf7261de428d66c3f4400ee4ce3798a97dcd6808f862825146fb0db545c82c7487916

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1F95.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
529KB

MD5
0166d6c0688a753a3c1d2bb4230f520f

SHA1
8f2de698dd017204bc8bf85b4c28970362b60963

SHA256
31a1806b173129f4442bc5e76f5e10b83a84a92f0887f3b73fa67b07f0a60380

SHA512
584d149cf2f614d6063957a9f5ed3a5e0c1730dec8475636991bffad6ae89adb5b94e4dc28df349dac8632f0de0365f80646e9c7a383541d2effe60d752739b9

Download Submit