3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9

Analysis

max time kernel
93s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uninstall.exe
Size 51KB
Sample240205-bzg7vsffc5
SHA256 625d52d73b2a00841751eb9bb106d91c74703b7f12e7a56c6950070190dc6e58
MD5 bd7e4a59e9c46c47a5442d271fd582ee
SHA1 7119ce221917e6f0791746a9ba5ee6df1ac87e01
SHA512 a9cf689dded2866e9bfdab34c5199c41db9498f46299919d9d68b4d5676317477c898308e674e06a5bbde5c3275a739b3a6a316ac93ca86bfabdea7636a2ae6f
SSDEEP 1536:wLXB65939tY6HBg4sXJJl73Gl1VhzDRE9U+idVe:wLk395hYXJ77YTve9WDe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4588	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
4588	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral18/files/0x0007000000023107-3.dat	nsis_installer_1
behavioral18/files/0x0007000000023107-3.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4588	2468	Uninstall.exe	82
PID 2468 wrote to memory of 4588	2468	Uninstall.exe	82
PID 2468 wrote to memory of 4588	2468	Uninstall.exe	82

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrCA94.tmp\UAC.dll
Size 13KB
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 51KB
SHA256 625d52d73b2a00841751eb9bb106d91c74703b7f12e7a56c6950070190dc6e58
MD5 bd7e4a59e9c46c47a5442d271fd582ee
SHA1 7119ce221917e6f0791746a9ba5ee6df1ac87e01
SHA512 a9cf689dded2866e9bfdab34c5199c41db9498f46299919d9d68b4d5676317477c898308e674e06a5bbde5c3275a739b3a6a316ac93ca86bfabdea7636a2ae6f
SSDEEP 1536:wLXB65939tY6HBg4sXJJl73Gl1VhzDRE9U+idVe:wLk395hYXJ77YTve9WDe
MD5 SHA1 SHA512 SSDEEP