Overview
overview
10Static
static
10VirusShare...12.exe
windows7-x64
9VirusShare...12.exe
windows10-2004-x64
9$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/$_1_.exe
windows7-x64
7$SYSDIR/$_1_.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$_5_.dll
windows7-x64
9$_5_.dll
windows10-2004-x64
9Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 22:55
Behavioral task
behavioral1
Sample
VirusShare-00c7e24b52d0f69c114772ed0a27f912.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
VirusShare-00c7e24b52d0f69c114772ed0a27f912.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
$SYSDIR/$_1_.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$SYSDIR/$_1_.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
$_5_.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$_5_.dll
Resource
win10v2004-20231215-en
General
-
Target
$SYSDIR/$_1_.exe
-
Size
49KB
-
MD5
154274f2095724e826822bc695dac0bb
-
SHA1
bf6c7eb599a7039ae6d18a24f120533842a006ef
-
SHA256
70d43e3594e461b1baa0574668fcd7d9b2ac7741d3245b8f4f868e5ef07ed986
-
SHA512
fff766cc90ff31b47019284d62fdd168977ec199261b93421e0316172324164e718597833f35790ee0e8e050e6e4bf0c1cf136f1ff8948450e2692c814c1fb03
-
SSDEEP
1536:upgpHzb9dZVX9fHMvG0D3XJn5wFsVSf2J:0gXdZt9P6D3XJn5qqSOJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2264 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 1976 $_1_.exe 2264 Au_.exe 2264 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral5/files/0x000d0000000122c4-2.dat nsis_installer_1 behavioral5/files/0x000d0000000122c4-2.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2264 1976 $_1_.exe 28 PID 1976 wrote to memory of 2264 1976 $_1_.exe 28 PID 1976 wrote to memory of 2264 1976 $_1_.exe 28 PID 1976 wrote to memory of 2264 1976 $_1_.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$_1_.exe"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$_1_.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457B
MD56dcc9c40639344d7ccab94186e42991a
SHA15afcde6bb2a4786fcf490a674c513dad92fd2f64
SHA256dceed7449259f6022fb4ecc40fdf70ee9fc4bf36554bcd8b9f5c011f4846b5dd
SHA512f7297c43335ecbf143f3c0f295033f1710a034c6e199d3634675da0e873cef05de71510ce0bc43f47dd55ed3e3dd6d0fe4128d4f03edf184019c0ba2906607ec
-
Filesize
509B
MD59eb036a70bdedec68187d7c7cce9d3b9
SHA103da275134bccc9d80c2b513d6615e0e68f218a9
SHA2563950ccf060ff14e7cd930e5f8f42eed0b970147f6925acb780ad984c59ea2c58
SHA5125ea29a00642cd8c54c35a6ba190c5a52669cad0e11b20071d9f2a5c728592bed98af1cdbc15fec6f1684e003977edae255f335086239dab31e4241793f943ff9
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
49KB
MD5154274f2095724e826822bc695dac0bb
SHA1bf6c7eb599a7039ae6d18a24f120533842a006ef
SHA25670d43e3594e461b1baa0574668fcd7d9b2ac7741d3245b8f4f868e5ef07ed986
SHA512fff766cc90ff31b47019284d62fdd168977ec199261b93421e0316172324164e718597833f35790ee0e8e050e6e4bf0c1cf136f1ff8948450e2692c814c1fb03