fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900

Analysis

max time kernel
86s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninstall.exe
Size 289KB
Sample240204-qf6tfaade2
SHA256 9372aeff962ad6c69df8f6775b46b85302de99b91896a2544795038d605e4b02
MD5 566f254a5b3a10f66f20cc4049cb67a7
SHA1 5bb8fea73edbce4d1feaced7dee122fbed000313
SHA512 f5ba513532946751a247870965fa2252cc6bae357c4781b0cec670bcedd5751fb867d6e29763c008e6e482b12d914556c08e7a769a6f92a0738d8eabbaca410a
SSDEEP 6144:Ue34Z3Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmJ:03q4OaQQTYJ8eP4/L5uO7D3f5BQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4208	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
4208	Au_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral14/files/0x0006000000023216-4.dat	nsis_installer_1
behavioral14/files/0x0006000000023216-4.dat	nsis_installer_2
behavioral14/files/0x0006000000023216-3.dat	nsis_installer_1
behavioral14/files/0x0006000000023216-3.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4208	4576	uninstall.exe	18
PID 4576 wrote to memory of 4208	4576	uninstall.exe	18
PID 4576 wrote to memory of 4208	4576	uninstall.exe	18

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aminsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw6523.tmp\aminsis.dll
Size 204KB
SHA256 236cba16c6daa6c2e7ae8554d96063563cdee2eb1ad050e4392e9f644de07e74
MD5 7483a32757ccaaeda73db78943a541db
SHA1 4ae177f7856a6b9c38dbf194e0fcfacefcc29740
SHA512 6cf23d0e331ff1ef51853c9f33b6fc3854a9f2c17acc8ff01e33d334bad76731f34be297b35700a987257986a73870db7b4aa6456bafad96ba42c7443bfc7d21
SSDEEP 6144:i/x6yBnSkctdh7NfMcl03Uz1ppngH8dHnce:i/x6GnSkidh7NfMc4G1ppgH811
MD5 SHA1 SHA512 SSDEEP

Submit Download

aminsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw6523.tmp\aminsis.dll
Size 111KB
SHA256 014685f6372d287487162e75f3ece6440084b884bf55e2fb3d7a395adb74c7fa
MD5 a30317349d926c38386e267fea4832f6
SHA1 de5af0b71059fe3d0a612b0beeb3010f5b5ba9b2
SHA512 6962e81a483d64b9b77227c05c52e48c7ac25e04788cf7b21ef9f3c34544613169e49dc23968dc520cc214a66b2ea452b5c01539b109c2360737e84dec0b9f96
SSDEEP 3072:i/x6yjd7nSkcx0a4U5n7NfMcCGFqF3J6i9IC:i/x6yBnSkctdh7NfMcl03UzC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 96KB
SHA256 1d7819083cd067c1d9fa15cb916891d15a739ab35d8c6b208e48c63b4beb2881
MD5 4ee4674e1fa23ddc58b9bed44d75355f
SHA1 b5f313d95bb7aae072458dd55298560cce16e82e
SHA512 173de28356c6232f388b66ec88dc2a880e057306714ed53f8c4551df4200fa020a7b06f3964d66a87df8f7c1524c0073aec2fe851d625ae48a77af7e6db76e10
SSDEEP 3072:UgXdZt9P6D3XJPzF1oqRgWsrKJizC18agfzwuHgY:Ue34Z3Rg4l8ai5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 128KB
SHA256 a0a74cbaff3ac246567d2d922b75672fd27bb82789defe3bb571ca4db3694a2b
MD5 a7012943ba71b5bdaad5a8c368867554
SHA1 06499652ec329922a5753d6cecd7b48a93bacfa5
SHA512 a16aea733c197e403f58ab56d3cc9b1faa476c39dbbf0c53426b369cf4e86389a95d9ae74ada40e4b57689408049fbfde07528b589e30ae654086140bf25fe4b
SSDEEP 3072:UgXdZt9P6D3XJPzF1oqRgWsrKJizC18agfzwuHgCQeI7N399NlzPf:Ue34Z3Rg4l8ai5PQtTZ7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads