Analysis

  • max time kernel
    132s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 13:32

General

  • Target

    uninstall.exe

  • Size

    141KB

  • MD5

    09820f817dbda346df79cf7e4783d1c0

  • SHA1

    19de41e955f8603afe293faf084180deef0a16cf

  • SHA256

    25d1cf0981a9dc5e199a49e7daa4648ad2899d208a44c52e62717ed5d511208c

  • SHA512

    3ec04c7d9673976485be7f8bb0cf08e24dc48a0f1f0fc82044bd52433514ea7f0b569a35c7dea21ca4a0579130549e9ce7a807dc1522fb5b64da4ff2e343051b

  • SSDEEP

    3072:nLk395hYXJhVTHMHYcVgInAXwC18Sbct5:nQqjVbM4lIAXwCm5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2220

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          141KB

          MD5

          09820f817dbda346df79cf7e4783d1c0

          SHA1

          19de41e955f8603afe293faf084180deef0a16cf

          SHA256

          25d1cf0981a9dc5e199a49e7daa4648ad2899d208a44c52e62717ed5d511208c

          SHA512

          3ec04c7d9673976485be7f8bb0cf08e24dc48a0f1f0fc82044bd52433514ea7f0b569a35c7dea21ca4a0579130549e9ce7a807dc1522fb5b64da4ff2e343051b

        • \Users\Admin\AppData\Local\Temp\nsm64E5.tmp\LangDLL.dll

          Filesize

          5KB

          MD5

          a401e590877ef6c928d2a97c66157094

          SHA1

          75e24799cf67e789fadcc8b7fddefc72fdc4cd61

          SHA256

          2a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0

          SHA512

          6093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f