03a909dec05f764304e2916f1ad69c0146ce444c952b104e2262a8f107154a3e

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall.exe
Size

442KB
MD5

1cfaf32714bda91f4cb7ede7d7118974
SHA1

f6e3ce246751c4692cfec88ae5832c7670f32aae
SHA256

d0a8add51ef59e7bd1f0c9dc015bb85ae44be8b3b468a38fa1fcc60555519cd5
SHA512

91d16fa33d5e027740756d4d2cbe88f6c35162106bc059f565981724395e9a5e7559255e3d01356b7efb15ee6ed54ecc414b53d444eb560c9b258e3d484f611f
SSDEEP

6144:0e34umb13SbMGb7xS0O6dSeNRTvzVIGHjZm7qGmsp3dH09y/SdwZzg8ANBTbRUJp:XmJMRo0dHvZjZLGFSGzBg8EtbQd/

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3056	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
3056	Au_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral14/files/0x000900000002326e-3.dat	nsis_installer_1
behavioral14/files/0x000900000002326e-3.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3056	2116	uninstall.exe	97
PID 2116 wrote to memory of 3056	2116	uninstall.exe	97
PID 2116 wrote to memory of 3056	2116	uninstall.exe	97

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoF609.tmp\aminsis.dll

Filesize
834KB

MD5
14ad04243334645f399639b028f21d17

SHA1
7368866dc95621a1407d2105d040da2cc9852ba9

SHA256
02d13f28df1314640474ee77cd202a2c0da8e1d609c614f8fdff4451f8ee63fa

SHA512
3859b6f6e7e46ba70fa0be24fd2ceadf3db746818f11a09109c7bb678ee4fc08824a0cf15c77df09c3b2bdc2a80067a98130660152f5ee61e4bd501ef5ed1728

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
442KB

MD5
1cfaf32714bda91f4cb7ede7d7118974

SHA1
f6e3ce246751c4692cfec88ae5832c7670f32aae

SHA256
d0a8add51ef59e7bd1f0c9dc015bb85ae44be8b3b468a38fa1fcc60555519cd5

SHA512
91d16fa33d5e027740756d4d2cbe88f6c35162106bc059f565981724395e9a5e7559255e3d01356b7efb15ee6ed54ecc414b53d444eb560c9b258e3d484f611f

Download Submit