Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
23-03-2024 17:44
General
-
Target
$PLUGINSDIR/uninstall.exe
-
Size
8.1MB
-
MD5
b73940b9b108c8196600617a7f734d64
-
SHA1
f70aee50bcd93db0180ac0969126562882934bd4
-
SHA256
5bd33a6ba5e012c3e6f8ccc5ab322728d5df31e9e7b74daaf327aa54fc95028f
-
SHA512
ebd98143c766b12e12198ce8b310423cd6e4e638fca809afb006ff5953f65ee820b7140264bc93cbfe2f6015d4e00f26b696e7773ee55ad6da67baf5d973cc02
-
SSDEEP
196608:+l18/QDobE0TSkJzTtpQF6ZBPTS8y5BFwGIR6ip2eyWzi+8LX+1ZxWj:+H8/1EglTvS+S897pgGiNLeZxG
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe" "av:1.0.1" "gv:1.0.1.1" "gs:Official-com" "gi:UA-85655135-28" "an:DroidKit" "c:iMobie"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5d8fca35ff95fe00a7174177181f8bd13
SHA1fbafea4d2790dd2c0d022dfb08ded91de7f5265e
SHA256ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
SHA512eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
5.0MB
MD52a00f9cf62e6d1ed89da8cc62758b496
SHA124688ed8c055fb490d8bfaab4fea0aaef6e75739
SHA256530add38655df4d982c4e52318e86dd8ca7e97a292c7f10966399fb1e325392e
SHA5122c4ca0aed245d792b7a91e6081567ef89abb505af53ad634801c05eb20f544905d75aa1b782318fd5886cdfcc1a33d76d321f1efbe6bb7efd77e1be11bdfd1e8
-
Filesize
866KB
MD5790d0f8915a0f545df19e1c057dc9c8e
SHA1838985922bdd1a9986140bfe9950d2d5f4663657
SHA2566cfeb83384f5a321d3e5bed8cb6457ed790215fede7a248bd7cf79cef1db02dd
SHA512655b87fb493120e599296acda71ea985f53bd37c84f3ccb0683adbc0f9c0ee0db0643cf4d1232a5a8b44a985648eabfe98c08b267a2c4abbd1e5441857e8f4ca
-
Filesize
960KB
MD5076d97a224762a4f416b45e8b2293cca
SHA180adbd540ab546b4cd8627facae63c5723101d9d
SHA25645a58db29cfd5befcca7a803a71a0528a61cb1b9068f86893b5777caacc41bf1
SHA512ac76c817464b0491157483a649a27f7709434388d3f2fa64dbba8640303617990b3c1c282633daf02505cc8a5404b42c36daba4c72ba9d6ca1a29b8e2867d8a2
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
360KB
-
Filesize
128KB
-
Filesize
7.5MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB