Overview
overview
7Static
static
3VirusShare...b2.exe
windows7-x64
7VirusShare...b2.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffMediaWat...ion.js
windows7-x64
1ffMediaWat...ion.js
windows10-2004-x64
1ff/chrome/...046.js
windows7-x64
1ff/chrome/...046.js
windows10-2004-x64
1ff/chrome/...ion.js
windows7-x64
1ff/chrome/...ion.js
windows10-2004-x64
1ie/MediaWa...46.dll
windows7-x64
6ie/MediaWa...46.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_6cef53812dca6db17872a41b15b28cb2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
VirusShare_6cef53812dca6db17872a41b15b28cb2.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ffMediaWatchV1home3046chaction.js
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ffMediaWatchV1home3046chaction.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffMediaWatchV1home3046.js
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffMediaWatchV1home3046.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffMediaWatchV1home3046ffaction.js
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffMediaWatchV1home3046ffaction.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
ie/MediaWatchV1home3046.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
ie/MediaWatchV1home3046.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
General
-
Target
uninstall.exe
-
Size
285KB
-
MD5
bfe2be2406fc6a1427ccb70ec0c9d882
-
SHA1
f5b35571cc47673bb27e8e4ddddc2295fa1a4863
-
SHA256
39053d2fb6b3463d8270530fa09351156da25348e186eb33511980d7a6c5b8cd
-
SHA512
98c1361ffdfa347d1eefc8faf1503f7479ee70be9a96b04779fdcca0663318b44376fb8d5970e83b9fb6dbe8ec3d2cae0796721f753ab03acea7d7a62ec1a4e5
-
SSDEEP
6144:Ee34nlpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1T:+TeZHkwuPikQ7lKH5p5H9x1T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2360 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 2940 uninstall.exe 2360 Au_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral13/files/0x000c0000000139e6-2.dat nsis_installer_1 behavioral13/files/0x000c0000000139e6-2.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2360 2940 uninstall.exe 28 PID 2940 wrote to memory of 2360 2940 uninstall.exe 28 PID 2940 wrote to memory of 2360 2940 uninstall.exe 28 PID 2940 wrote to memory of 2360 2940 uninstall.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
559KB
MD551ba1095f0ae45a2d444bea506cb9ad4
SHA1038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA256b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
SHA512f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
-
Filesize
285KB
MD5bfe2be2406fc6a1427ccb70ec0c9d882
SHA1f5b35571cc47673bb27e8e4ddddc2295fa1a4863
SHA25639053d2fb6b3463d8270530fa09351156da25348e186eb33511980d7a6c5b8cd
SHA51298c1361ffdfa347d1eefc8faf1503f7479ee70be9a96b04779fdcca0663318b44376fb8d5970e83b9fb6dbe8ec3d2cae0796721f753ab03acea7d7a62ec1a4e5