fe22e0a3594bff1aaa8daa3d102e840bde89ea342a3e16dfb1ee298f08e5696f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$3/$APPDATA/TablacusApp/uninstaller.exe
Size

39KB
MD5

b0462ccb1a0a065caa4e0fe79cde336a
SHA1

38fac4faa072f0b1acb3159328c9c0685721226e
SHA256

79681af3c6d910b5e4239f498d183a8da375156dc2b77ad8b930582e152c4a10
SHA512

3cae3132b2ea5b364091d48cafe952812d8f68aba572661b0c1465579f4b09cf5d74bce4e51ce651b60994caf567c83e72b14fa26a81fa510ce31138d52a3f37
SSDEEP

768:2JKOdm9o29rJYypQJ2JQJXJuKU+duC1ZHQ0D3LHSGiVNuCJRnTb6z:iTdm9B9lYypfMXvugHQ0DbLiNuEb6z

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2368	Un_A.exe

Loads dropped DLL 1 IoCs

pid	Process
1420	uninstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2368	1420	uninstaller.exe	28
PID 1420 wrote to memory of 2368	1420	uninstaller.exe	28
PID 1420 wrote to memory of 2368	1420	uninstaller.exe	28
PID 1420 wrote to memory of 2368	1420	uninstaller.exe	28

C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\TablacusApp\uninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\TablacusApp\uninstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\TablacusApp\
  2⤵
  - Executes dropped EXE
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
39KB

MD5
b0462ccb1a0a065caa4e0fe79cde336a

SHA1
38fac4faa072f0b1acb3159328c9c0685721226e

SHA256
79681af3c6d910b5e4239f498d183a8da375156dc2b77ad8b930582e152c4a10

SHA512
3cae3132b2ea5b364091d48cafe952812d8f68aba572661b0c1465579f4b09cf5d74bce4e51ce651b60994caf567c83e72b14fa26a81fa510ce31138d52a3f37

Download Submit