87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9

Analysis

max time kernel
209s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240221-es
resource tags

arch:x64arch:x86image:win10-20240221-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
11-03-2024 18:53

Target

GeodeUninstaller.exe
Size

84KB
MD5

b7d4ad3ce687a4a8524a6b17b71ee065
SHA1

92cfe1d4a16f15d87dd69244326a77c1422fe76f
SHA256

619219cf5bd0f7413bf31b34b4f578ad610cc2be8289dccb3555dea06642b28c
SHA512

02fa2043793eefe200667a55d1fa6655a1a4d99efb723c19edd4e54f5f47c7c910440b0a57a57d65d8daeebab65490d6d6a3cdc36e20179230af8b91d800267c
SSDEEP

1536:UferrLkSRoe8C4UZsys0Dh1duX6ekrm2y5rTX7IS0hyv4uL7010n6BBF5:Ufi3k+oWDBDh1dun+y5r8hGN70+n6Xf

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un.exe

pid process

220 Un.exe
Loads dropped DLL 1 IoCs

Processes:

Un.exe

pid process

220 Un.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
220	Un.exe

pid	process
220	Un.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

GeodeUninstaller.exe

description	pid	process	target process
PID 96 wrote to memory of 220	96	GeodeUninstaller.exe	Un.exe
PID 96 wrote to memory of 220	96	GeodeUninstaller.exe	Un.exe
PID 96 wrote to memory of 220	96	GeodeUninstaller.exe	Un.exe

C:\Users\Admin\AppData\Local\Temp\GeodeUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\GeodeUninstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:96

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe

Filesize
84KB

MD5
b7d4ad3ce687a4a8524a6b17b71ee065

SHA1
92cfe1d4a16f15d87dd69244326a77c1422fe76f

SHA256
619219cf5bd0f7413bf31b34b4f578ad610cc2be8289dccb3555dea06642b28c

SHA512
02fa2043793eefe200667a55d1fa6655a1a4d99efb723c19edd4e54f5f47c7c910440b0a57a57d65d8daeebab65490d6d6a3cdc36e20179230af8b91d800267c

Download Submit
\Users\Admin\AppData\Local\Temp\nsf7A80.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit