692878ac81e6439a2af9d3e558b4456a5abae4c029a196b62e8b5b316fd3571b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gkamus-uninst.exe
Size

63KB
MD5

6305547a12e0e04228d42228ad6a504d
SHA1

f0b4d68c40a5738acc4ce718e14751d67446b165
SHA256

1e9db3d7ce31b8804ed9768621de21cd1144c0a1b8ed7e916eeb91dca13475de
SHA512

ad5a4aaca3d5b70c7a0f0dd82f4f71b5f80193411720ad8812ede6a3f996efb786309566c7f22c5beca2d1b1985ade15b7fb298d24d15333756e6fe183b42378
SSDEEP

1536:BmZw+QfiexLgJ/RQGcrnfDjuNgdLeAyN7BcT3hoVz:BmpQFx8/qGOnfDjuNceAYcF0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

1796 Au_.exe
Loads dropped DLL 1 IoCs

Processes:

gkamus-uninst.exe

pid process

2900 gkamus-uninst.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Au_.exe

pid process

1796 Au_.exe

pid	process
1796	Au_.exe

pid	process
2900	gkamus-uninst.exe

pid	process
1796	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

gkamus-uninst.exe

description	pid	process	target process
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe
PID 2900 wrote to memory of 1796	2900	gkamus-uninst.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\gkamus-uninst.exe
"C:\Users\Admin\AppData\Local\Temp\gkamus-uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1796

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
Filesize
63KB

MD5
6305547a12e0e04228d42228ad6a504d

SHA1
f0b4d68c40a5738acc4ce718e14751d67446b165

SHA256
1e9db3d7ce31b8804ed9768621de21cd1144c0a1b8ed7e916eeb91dca13475de

SHA512
ad5a4aaca3d5b70c7a0f0dd82f4f71b5f80193411720ad8812ede6a3f996efb786309566c7f22c5beca2d1b1985ade15b7fb298d24d15333756e6fe183b42378

Download Submit