fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninstall.exe
Size 289KB
Sample240204-qf6tfaade2
SHA256 9372aeff962ad6c69df8f6775b46b85302de99b91896a2544795038d605e4b02
MD5 566f254a5b3a10f66f20cc4049cb67a7
SHA1 5bb8fea73edbce4d1feaced7dee122fbed000313
SHA512 f5ba513532946751a247870965fa2252cc6bae357c4781b0cec670bcedd5751fb867d6e29763c008e6e482b12d914556c08e7a769a6f92a0738d8eabbaca410a
SSDEEP 6144:Ue34Z3Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmJ:03q4OaQQTYJ8eP4/L5uO7D3f5BQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2092	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
2912	uninstall.exe
2092	Au_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral13/files/0x000d000000012325-2.dat	nsis_installer_1
behavioral13/files/0x000d000000012325-2.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2092	2912	uninstall.exe	28
PID 2912 wrote to memory of 2092	2912	uninstall.exe	28
PID 2912 wrote to memory of 2092	2912	uninstall.exe	28
PID 2912 wrote to memory of 2092	2912	uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aminsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd26A4.tmp\aminsis.dll
Size 82KB
SHA256 4d2c9f340a4f67cd4b9e7a7ae480f4587a6c821cd9a33fe8155b5d1a6880f025
MD5 32b6cc63f5f4e0c46e5e740f243b4cb0
SHA1 aba7b13d6503a54a8c48e9cd649bd0a2cdd500dd
SHA512 2cc229eec3a15f53fe371a1def2da65f265a8dc171bacc95926e04d7538f6ba90677d81877d05599a410c9280d9fd9f849afd982ee440daefa408bc026bbb999
SSDEEP 1536:ni/x6y4+ASufqnSkyUUUUFjx0a4U5ntVzZMGMwfCW1fFqas3JZH3:i/x6yjd7nSkcx0a4U5n7NfMcCGFqF3Jt
MD5 SHA1 SHA512 SSDEEP

Submit Download

aminsis.dll

Path \Users\Admin\AppData\Local\Temp\nsd26A4.tmp\aminsis.dll
Size 91KB
SHA256 ac0ad37e22a32e2a121cfc30e6a7913f75f80f97240851ee0f679ed010a27d09
MD5 cb2b1ace64f7ffdb5a048a099d46e241
SHA1 a964ed8a3974fe528f1061e6a18b142d804420d5
SHA512 5f20922e8968ad974742e0f23e3b91a45c865b908043cffbefaafdd30495264a1e64e8d94b46be7a44028bec747119c862ce9fa28afd21b6bf725c934bcc66bb
SSDEEP 1536:ni/x6y4+ASufqnSkyUUUUFjx0a4U5ntVzZMGMwfCW1fFqas3JZH/W:i/x6yjd7nSkcx0a4U5n7NfMcCGFqF3Jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 289KB
SHA256 9372aeff962ad6c69df8f6775b46b85302de99b91896a2544795038d605e4b02
MD5 566f254a5b3a10f66f20cc4049cb67a7
SHA1 5bb8fea73edbce4d1feaced7dee122fbed000313
SHA512 f5ba513532946751a247870965fa2252cc6bae357c4781b0cec670bcedd5751fb867d6e29763c008e6e482b12d914556c08e7a769a6f92a0738d8eabbaca410a
SSDEEP 6144:Ue34Z3Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmJ:03q4OaQQTYJ8eP4/L5uO7D3f5BQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads