Overview
overview
7Static
static
3VirusShare...fe.exe
windows7-x64
7VirusShare...fe.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffRichMedi...ion.js
windows7-x64
1ffRichMedi...ion.js
windows10-2004-x64
1ff/chrome/...e45.js
windows7-x64
1ff/chrome/...e45.js
windows10-2004-x64
1ff/chrome/...ion.js
windows7-x64
1ff/chrome/...ion.js
windows10-2004-x64
1ie/RichMed...45.dll
windows7-x64
6ie/RichMed...45.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_abfb01a66ce9f58efb046a181a0e83fe.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
VirusShare_abfb01a66ce9f58efb046a181a0e83fe.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
ffRichMediaViewV1release45chaction.js
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ffRichMediaViewV1release45chaction.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffRichMediaViewV1release45.js
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffRichMediaViewV1release45.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffRichMediaViewV1release45ffaction.js
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffRichMediaViewV1release45ffaction.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
ie/RichMediaViewV1release45.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
ie/RichMediaViewV1release45.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
General
-
Target
uninstall.exe
-
Size
289KB
-
MD5
e3060e62ffae169cdd7697724969b782
-
SHA1
f6d6e508ae0ca90e95728e47fda796dcde327eae
-
SHA256
119ff5d8f893e9543e07969ed9ec031c32ed2b73f5ca6c5a10ec552499c7694b
-
SHA512
7ff9f9900e2d9ee6b3cdda13aa60fbd658f66a0650505fafb51b0b4de03105bc03751864c0f966e52d98a9944a160e2daf9b07464cdb37a3e566365ebc0a49fb
-
SSDEEP
6144:Ue34EHRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmn:5Hq4OaQQTYJ8eP4/L5uO7D3f5BG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1716 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 1716 Au_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
resource yara_rule behavioral14/files/0x0006000000023223-4.dat nsis_installer_1 behavioral14/files/0x0006000000023223-4.dat nsis_installer_2 behavioral14/files/0x0006000000023223-3.dat nsis_installer_1 behavioral14/files/0x0006000000023223-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1376 wrote to memory of 1716 1376 uninstall.exe 31 PID 1376 wrote to memory of 1716 1376 uninstall.exe 31 PID 1376 wrote to memory of 1716 1376 uninstall.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
567KB
MD5450753ad96785a240a39deccab3af0d0
SHA121c544064d2ffa6444508268ce258a330d459fc5
SHA2561c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
SHA512c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
-
Filesize
184KB
MD50c191be2550c21f91a0ba85ef2873083
SHA1b4274396898453cae20a944060458f81cc4458de
SHA25628c7f2f1346e5e0376795863940eea4ac4990aae3847f90c16595b265a4ebd0f
SHA512a2834812551a5df69d208475d09ea97bad7c39b5ebdb7aa3c6d90c07e5887bdc528571f3add7efac322bb303614df1469903c824e4203616c77bab18b314308b
-
Filesize
95KB
MD57a94a5fb85a56204602b977abb69972b
SHA1fa1c814a1ff40d3a407933b3babc90ee3f9884b1
SHA256bb6012c88148ad61a3a7f7a2926f37e5a9e50c9e63beaed2f84f0a3e661c806c
SHA5129a8d7dc379e175ab93c37202ddc525c34924c6397ab231f2574c1523ec6ac11f2090e5f3221d5fa6f74bb08d861ed8b6a9ca084ab45f9338288e9893c3007fd3