Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 22:55

General

  • Target

    $SYSDIR/$_1_.exe

  • Size

    49KB

  • MD5

    154274f2095724e826822bc695dac0bb

  • SHA1

    bf6c7eb599a7039ae6d18a24f120533842a006ef

  • SHA256

    70d43e3594e461b1baa0574668fcd7d9b2ac7741d3245b8f4f868e5ef07ed986

  • SHA512

    fff766cc90ff31b47019284d62fdd168977ec199261b93421e0316172324164e718597833f35790ee0e8e050e6e4bf0c1cf136f1ff8948450e2692c814c1fb03

  • SSDEEP

    1536:upgpHzb9dZVX9fHMvG0D3XJn5wFsVSf2J:0gXdZt9P6D3XJn5qqSOJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$_1_.exe
    "C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$_1_.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3296

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsn9A6D.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

        • C:\Users\Admin\AppData\Local\Temp\nsn9A6D.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        • C:\Users\Admin\AppData\Local\Temp\nsn9A6D.tmp\validate.ini

          Filesize

          509B

          MD5

          04765cfa53f80daaea8d1037772c8b50

          SHA1

          047b84125e531f64cff45086dfa555c82e59af44

          SHA256

          8aab85fc8f0515c10308d847e09e696e71052aefb8b669bfb31df4a39686fa4c

          SHA512

          bcf69bf06c648cc4f610dcb484b9a784207710f2814931b47c7d48bf47e94bfbeaf53e03e7dcaa96fc71c1e7aacd45b81af1c611b112faf772a601a2e5c324eb

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          49KB

          MD5

          154274f2095724e826822bc695dac0bb

          SHA1

          bf6c7eb599a7039ae6d18a24f120533842a006ef

          SHA256

          70d43e3594e461b1baa0574668fcd7d9b2ac7741d3245b8f4f868e5ef07ed986

          SHA512

          fff766cc90ff31b47019284d62fdd168977ec199261b93421e0316172324164e718597833f35790ee0e8e050e6e4bf0c1cf136f1ff8948450e2692c814c1fb03