Overview

overview

8

Static

static

1

adusetupip...xt.exe

windows10-1703-x64

8

adusetupip...xt.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    1792s
  • max time network
    1159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-08-2023 02:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    adusetupipg_googleadw-adu_gads_usa_ext.exe

  • Size

    8.8MB

  • MD5

    2335a750096cb245737b423794866a82

  • SHA1

    29c676cf08535b01889a94bd181bc22f5d70459e

  • SHA256

    7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d

  • SHA512

    6f43936fb086c9e2da62fe29f76f4206bf33e17fd8d853371808873dfe536f8c0978c4db3e79f55f533c11cbeaba65f9841b5175e8d3a1d32c98f6d0c20fc7f9

  • SSDEEP

    196608:lDDbq7CsUmsR1V085lc6oLMmoOHImE459rmO3fXNDcfMvXi:lDDO7C31R1Vp36xzzjDaO3fW0vy

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 4 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adusetupipg_googleadw-adu_gads_usa_ext.exe
    "C:\Users\Admin\AppData\Local\Temp\adusetupipg_googleadw-adu_gads_usa_ext.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:996
    • C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp" /SL5="$4021A,8637066,199680,C:\Users\Admin\AppData\Local\Temp\adusetupipg_googleadw-adu_gads_usa_ext.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4636
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:952
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4568

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp
    Filesize

    1.2MB

    MD5

    cd31650b1825f94d40916975931def27

    SHA1

    797184e1856305b590ea138f6fa4139499c1f60b

    SHA256

    04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

    SHA512

    13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-2D7UC.tmp\adusetupipg_googleadw-adu_gads_usa_ext.tmp
    Filesize

    1.2MB

    MD5

    cd31650b1825f94d40916975931def27

    SHA1

    797184e1856305b590ea138f6fa4139499c1f60b

    SHA256

    04449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f

    SHA512

    13d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-4V5FM.tmp\isxdl.dll
    Filesize

    152KB

    MD5

    82201cd8f401f00000b7575b24b3ad0b

    SHA1

    fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

    SHA256

    9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

    SHA512

    a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Systweak\adu\ipini.ini
    Filesize

    12B

    MD5

    71d587e911373f62d72a158eceb6e0e7

    SHA1

    68d81a1a4fb19c609288a94f10d1bbb92d972a68

    SHA256

    acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8

    SHA512

    a0010c487c8b1eeae82ae82896bf5f48b7ec5573197bbe149b6803093a32b3b470ef0b122278e404cd5df296376bb0629438609997d52c14757ff1c3e6756060

    Download Submit
  • memory/216-7-0x0000000002430000-0x0000000002431000-memory.dmp
    Filesize

    4KB

    Download
  • memory/216-29-0x0000000000400000-0x000000000053E000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/216-30-0x0000000002430000-0x0000000002431000-memory.dmp
    Filesize

    4KB

    Download
  • memory/996-1-0x0000000000400000-0x000000000043B000-memory.dmp
    Filesize

    236KB

    Download
  • memory/996-28-0x0000000000400000-0x000000000043B000-memory.dmp
    Filesize

    236KB

    Download