Overview
overview
10Static
static
106e9fdbd85c...ef.exe
windows7-x64
16e9fdbd85c...ef.exe
windows10-2004-x64
1"AKL.dll
windows7-x64
3"AKL.dll
windows10-2004-x64
3"AKL.exe
windows7-x64
1"AKL.exe
windows10-2004-x64
1"AKL.dll
windows7-x64
1"AKL.dll
windows10-2004-x64
1"AKL.dll
windows7-x64
1"AKL.dll
windows10-2004-x64
1"AKL.chm
windows7-x64
1"AKL.chm
windows10-2004-x64
1"AKL.exe
windows7-x64
6"AKL.exe
windows10-2004-x64
6$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3AKV.exe
windows7-x64
1AKV.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7qs.html
windows7-x64
1qs.html
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-01-2024 03:37
Behavioral task
behavioral1
Sample
6e9fdbd85c3f5e072b9cbe6a5fe316ef.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e9fdbd85c3f5e072b9cbe6a5fe316ef.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
"AKL.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
"AKL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
"AKL.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
"AKL.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
"AKL.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
"AKL.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
"AKL.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
"AKL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
"AKL.chm
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
"AKL.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
"AKL.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
"AKL.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
AKV.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
AKV.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Uninstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Uninstall.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
qs.html
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
qs.html
Resource
win10v2004-20231215-en
General
-
Target
Uninstall.exe
-
Size
44KB
-
MD5
c30a8655799cdcf83ff2ac51af7da1f7
-
SHA1
f1a817a066e8f6e1c5472d484c9a38e54a1c348e
-
SHA256
d0bdf661871582c8086e5c753ba4d4d725371e3a5612a377cb41f2d144189594
-
SHA512
b13a422c7eff9b7bd4b391b854735317143ba321cb40a155df05dc2240f9653eeca67dd230117f606baad0832066073926030d4168f6f4d658ab347fde0aa33d
-
SSDEEP
768:9VSO0QdGLkD8HYayXJMIBImhiPbvu9/vHtLE8JGlzIvGmUgmoAql3/3:90mrcYRiiVhOuc8JmIhmoAqlv3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
A~NSISu_.exepid process 2692 A~NSISu_.exe -
Loads dropped DLL 4 IoCs
Processes:
Uninstall.exeA~NSISu_.exepid process 2444 Uninstall.exe 2692 A~NSISu_.exe 2692 A~NSISu_.exe 2692 A~NSISu_.exe -
NSIS installer 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\A~NSISu_.exe nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
A~NSISu_.exepid process 2692 A~NSISu_.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Uninstall.exedescription pid process target process PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe PID 2444 wrote to memory of 2692 2444 Uninstall.exe A~NSISu_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe"C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2692
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5c30a8655799cdcf83ff2ac51af7da1f7
SHA1f1a817a066e8f6e1c5472d484c9a38e54a1c348e
SHA256d0bdf661871582c8086e5c753ba4d4d725371e3a5612a377cb41f2d144189594
SHA512b13a422c7eff9b7bd4b391b854735317143ba321cb40a155df05dc2240f9653eeca67dd230117f606baad0832066073926030d4168f6f4d658ab347fde0aa33d