8d7abf40f309ae3c3dba5b6ce4c588a8ec4112f297e6a6369b8883e2ee2db4cb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall.exe
Size

55KB
MD5

e0600428ea866cbfb7a5bf371fabb690
SHA1

e549409619b867fcfe35cfb449819319fbf61fb3
SHA256

55a49dd4716b9eabe09c67b12cb225708ccedc6eba08824724b7152074a686ce
SHA512

33a8f5d62d51d700975e50b3b99fed0973eb868d117d934cb571148a2e03f41839aebc92e3d13b2320ae1f1babbbed5536dd572e28fb78b9d50851b2f5613e45
SSDEEP

768:4/UpAHiGjRQ1kkjH918xnyzOp7OssT1pF/O71mJ/Bgd2iZQAm6kRRS+NoJRnKN/4:8UeHiWRgkkjH8nyWmJZgdLeAyN9VgX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2260	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral14/files/0x000b000000023181-4.dat	nsis_installer_1
behavioral14/files/0x000b000000023181-4.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2260	4800	uninstall.exe	88
PID 4800 wrote to memory of 2260	4800	uninstall.exe	88
PID 4800 wrote to memory of 2260	4800	uninstall.exe	88

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
55KB

MD5
e0600428ea866cbfb7a5bf371fabb690

SHA1
e549409619b867fcfe35cfb449819319fbf61fb3

SHA256
55a49dd4716b9eabe09c67b12cb225708ccedc6eba08824724b7152074a686ce

SHA512
33a8f5d62d51d700975e50b3b99fed0973eb868d117d934cb571148a2e03f41839aebc92e3d13b2320ae1f1babbbed5536dd572e28fb78b9d50851b2f5613e45

Download Submit