Overview
overview
7Static
static
3Terraria_R...2_.exe
windows10-1703-x64
3Redist/dot...up.exe
windows10-1703-x64
7Redist/dxwebsetup.exe
windows10-1703-x64
7Redist/vcr...86.exe
windows10-1703-x64
7Redist/xna...st.msi
windows10-1703-x64
6Terraria.exe
windows10-1703-x64
3TerrariaServer.exe
windows10-1703-x64
3small-games.info.url
windows10-1703-x64
7start-server.bat
windows10-1703-x64
3steam_api.dll
windows10-1703-x64
1uninstall.exe
windows10-1703-x64
7$PLUGINSDI...LL.dll
windows10-1703-x64
3Analysis
-
max time kernel
132s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
04/04/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
Terraria_Rus_v1.1.2_.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Redist/dotNetFx40_Full_setup.exe
Resource
win10-20240319-en
Behavioral task
behavioral3
Sample
Redist/dxwebsetup.exe
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
Redist/vcredist_x86.exe
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
Redist/xnafx40_redist.msi
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
Terraria.exe
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
TerrariaServer.exe
Resource
win10-20240214-en
Behavioral task
behavioral8
Sample
small-games.info.url
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
start-server.bat
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
steam_api.dll
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
uninstall.exe
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10-20240221-en
General
-
Target
uninstall.exe
-
Size
141KB
-
MD5
09820f817dbda346df79cf7e4783d1c0
-
SHA1
19de41e955f8603afe293faf084180deef0a16cf
-
SHA256
25d1cf0981a9dc5e199a49e7daa4648ad2899d208a44c52e62717ed5d511208c
-
SHA512
3ec04c7d9673976485be7f8bb0cf08e24dc48a0f1f0fc82044bd52433514ea7f0b569a35c7dea21ca4a0579130549e9ce7a807dc1522fb5b64da4ff2e343051b
-
SSDEEP
3072:nLk395hYXJhVTHMHYcVgInAXwC18Sbct5:nQqjVbM4lIAXwCm5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2220 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 2220 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral11/files/0x000700000001abfd-3.dat nsis_installer_1 behavioral11/files/0x000700000001abfd-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4524 wrote to memory of 2220 4524 uninstall.exe 74 PID 4524 wrote to memory of 2220 4524 uninstall.exe 74 PID 4524 wrote to memory of 2220 4524 uninstall.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD509820f817dbda346df79cf7e4783d1c0
SHA119de41e955f8603afe293faf084180deef0a16cf
SHA25625d1cf0981a9dc5e199a49e7daa4648ad2899d208a44c52e62717ed5d511208c
SHA5123ec04c7d9673976485be7f8bb0cf08e24dc48a0f1f0fc82044bd52433514ea7f0b569a35c7dea21ca4a0579130549e9ce7a807dc1522fb5b64da4ff2e343051b
-
Filesize
5KB
MD5a401e590877ef6c928d2a97c66157094
SHA175e24799cf67e789fadcc8b7fddefc72fdc4cd61
SHA2562a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0
SHA5126093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f