Analysis
-
max time kernel
91s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
2593a4551b81b8ced21b1d87ee39d892.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2593a4551b81b8ced21b1d87ee39d892.exe
Resource
win10v2004-20231222-en
General
-
Target
2593a4551b81b8ced21b1d87ee39d892.exe
-
Size
241KB
-
MD5
2593a4551b81b8ced21b1d87ee39d892
-
SHA1
68d3bdf20cd01a3c21cf5209f6d79cb8cf3906f4
-
SHA256
f840a4ade87378a63c4ae90729ed6bb98392625e4c6c0ea7a44deb877b973c11
-
SHA512
5eb0a6c320e7a5f34cb4f9dfef0618185f07490c9788f2696b404c5fd74482985d25f07460f796ecca0acdbb90194a574bdd8cc1e3e34edaee75cbe9d31cf4d3
-
SSDEEP
6144:tZ+11DpSy/1RWBT52H3+qP5Jkk4J3nFwZm/G/Hc0cm:s0s1s152X+qRJ4Fp/G/80N
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2288 Au_.exe -
Loads dropped DLL 4 IoCs
pid Process 2288 Au_.exe 2288 Au_.exe 2288 Au_.exe 2288 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023221-3.dat nsis_installer_1 behavioral2/files/0x0007000000023221-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2288 2656 2593a4551b81b8ced21b1d87ee39d892.exe 89 PID 2656 wrote to memory of 2288 2656 2593a4551b81b8ced21b1d87ee39d892.exe 89 PID 2656 wrote to memory of 2288 2656 2593a4551b81b8ced21b1d87ee39d892.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2593a4551b81b8ced21b1d87ee39d892.exe"C:\Users\Admin\AppData\Local\Temp\2593a4551b81b8ced21b1d87ee39d892.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
Filesize
241KB
MD52593a4551b81b8ced21b1d87ee39d892
SHA168d3bdf20cd01a3c21cf5209f6d79cb8cf3906f4
SHA256f840a4ade87378a63c4ae90729ed6bb98392625e4c6c0ea7a44deb877b973c11
SHA5125eb0a6c320e7a5f34cb4f9dfef0618185f07490c9788f2696b404c5fd74482985d25f07460f796ecca0acdbb90194a574bdd8cc1e3e34edaee75cbe9d31cf4d3