7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$SYSDIR/$SYSDIR/$_14_.exe
Size 46KB
Sample240409-s2zclaee3t
SHA256 0edcfc77ab368f894127d802e26d27f7cc1eb275c7e9f18fea4e6ee748abccf4
MD5 394b247ea0586e4e8b52f3bd4e283504
SHA1 885d12398788a06b028ce98272b89bbb0f14dd81
SHA512 b751e26ac21545934e4a4479d6d1a80a740dc7af7daebe176399155a2cf1b8ee62bea0ca400cee635f0ebb92c5f0c0ecaafd7bfe85ac20812ea155b45dfc7000
SSDEEP 768:SSup23EQCjlQRB8/ewZ1iU6nyYFxbssT/F/O71mJ5TJRn0OSk3thG9bvLAoTlBBb:Hu4EQalMK/ewGnh0mJ6+3vobDAuTKe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3016	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
2148	$_14_.exe
3016	Au_.exe
3016	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral5/files/0x0009000000014aec-2.dat	nsis_installer_1
behavioral5/files/0x0009000000014aec-2.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3016	2148	$_14_.exe	28
PID 2148 wrote to memory of 3016	2148	$_14_.exe	28
PID 2148 wrote to memory of 3016	2148	$_14_.exe	28
PID 2148 wrote to memory of 3016	2148	$_14_.exe	28

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_14_.exe
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_14_.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

validate.ini

Path C:\Users\Admin\AppData\Local\Temp\nstE65C.tmp\validate.ini
Size 457B
SHA256 75f2b5627b967b2ea1651f925c5c0a14e37fef185574b82bc34ada2e5b4cff2e
MD5 ae199d1069b58174b86cf14113ad8fb8
SHA1 2791566d13e4568740c2691f90a8059d3c8f84cc
SHA512 e97419c26232c7343befb7efe9080d8213626cd31dbe74736b14182d7227c1a39bbfd32fd576ec38506bd6dd7fa89c7a60eaa912391a9bbbf816b84072234f07
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nstE65C.tmp\InstallOptions.dll
Size 14KB
SHA256 2ca5590c85cc31285b83bbe569755d909d91b559db2d6ce3bca2fcc075225364
MD5 06bef96b91bfa75b7f7817341a6cd597
SHA1 48a40368fc339ccea1dfda06d2e02bca7d7265c1
SHA512 5364d0944b4be215fb5d8bb8398e965ff6fa3190a962dd6c491984482321756017f89c2242d77ebcce6666c31fe54a956f2eb3a03a95d64121a1db462ad20a0d
SSDEEP 192:Q6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTtK72dwF7dBdcQOz:Q6JaVh4I5rpPbTt+BdhO
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nstE65C.tmp\System.dll
Size 10KB
SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
MD5 7e3c808299aa2c405dffa864471ddb7f
SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 46KB
SHA256 0edcfc77ab368f894127d802e26d27f7cc1eb275c7e9f18fea4e6ee748abccf4
MD5 394b247ea0586e4e8b52f3bd4e283504
SHA1 885d12398788a06b028ce98272b89bbb0f14dd81
SHA512 b751e26ac21545934e4a4479d6d1a80a740dc7af7daebe176399155a2cf1b8ee62bea0ca400cee635f0ebb92c5f0c0ecaafd7bfe85ac20812ea155b45dfc7000
SSDEEP 768:SSup23EQCjlQRB8/ewZ1iU6nyYFxbssT/F/O71mJ5TJRn0OSk3thG9bvLAoTlBBb:Hu4EQalMK/ewGnh0mJ6+3vobDAuTKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads