Overview
overview
7Static
static
37780f8eb62...0a.exe
windows7-x64
77780f8eb62...0a.exe
windows10-2004-x64
7$0/basicscan.dll
windows7-x64
1$0/basicscan.dll
windows10-2004-x64
1$0/basicscan.exe
windows7-x64
1$0/basicscan.exe
windows10-2004-x64
1$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
7780f8eb628d8b09292d1e2a74a06f0a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7780f8eb628d8b09292d1e2a74a06f0a.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$0/basicscan.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$0/basicscan.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$0/basicscan.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$0/basicscan.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
General
-
Target
$0/uninstall.exe
-
Size
78KB
-
MD5
a2a6e2fe649d7df57bc7c53c43b70d8d
-
SHA1
8909dccd63e93d13be0d7d2d13fc18213cd2fce0
-
SHA256
a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2
-
SHA512
afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69
-
SSDEEP
1536:PEkjY1zy214Qay0DGkJ7qAELVigJLcpub3RsagxxZ/RL32/DB:8kjAJ4dDGkJ+AI0F8hsagjZ/RLm/1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2872 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 2540 uninstall.exe 2872 Au_.exe 2872 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral7/files/0x000e0000000122ec-2.dat nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2872 Au_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2872 2540 uninstall.exe 28 PID 2540 wrote to memory of 2872 2540 uninstall.exe 28 PID 2540 wrote to memory of 2872 2540 uninstall.exe 28 PID 2540 wrote to memory of 2872 2540 uninstall.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
610B
MD5699d0e929c2972ccb32ce739e4119734
SHA1e52e3b154c6d7bd21f7be5fd734f610c73cb5293
SHA2565ed5b2e35e39edcadc84574513962c97f7a73119fece1f37c444ede4a3442b91
SHA5122782ab1ced8f5ad7d754ba4b47d0c7b4471a27f3becec5bf4ddac872ca3443db2d2e5c1e7535724f9ddeebf4339c982b3c0e7e2ff40ce8a275c04afcbb5d4c8b
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
78KB
MD5a2a6e2fe649d7df57bc7c53c43b70d8d
SHA18909dccd63e93d13be0d7d2d13fc18213cd2fce0
SHA256a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2
SHA512afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69