57def8e75b76c6ea0c1237935885f9a8ef9cc74da91c2b4e1ba0a52f8d52e236

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:08

Target

$APPDATA/Lighttwist Software/Excalibur/uninstall.exe
Size

37KB
MD5

fd2319aed9fe376159f11acabc94d87e
SHA1

541a86bad76ca23749dfe99ee9192130c3d48e7f
SHA256

02d72a5303330191e965ef252704f02a07be5a21e236aa676bb4fe8a2ceae947
SHA512

ab7f608237db2e1232d18665b8fdbcb4425f8ed99675b949a62a4f34ccc0fa9e8e63c81673a681a2f2fb0b6aef2a0340e7cdac18c2a685be1595fbadadf95dcc
SSDEEP

768:+nnw4xRMjJ8FBDOLQmzPjhAVHx10Z0D3yuInmBd0cOJRntup256:wnw8RSijDtSA5xeZ0DbBCcqupH

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

1708 Un_A.exe
Loads dropped DLL 1 IoCs

Processes:

uninstall.exe

pid process

1136 uninstall.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1708	Un_A.exe

pid	process
1136	uninstall.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 1136 wrote to memory of 1708	1136	uninstall.exe	Un_A.exe
PID 1136 wrote to memory of 1708	1136	uninstall.exe	Un_A.exe
PID 1136 wrote to memory of 1708	1136	uninstall.exe	Un_A.exe
PID 1136 wrote to memory of 1708	1136	uninstall.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$APPDATA\Lighttwist Software\Excalibur\
2⤵
- Executes dropped EXE
PID:1708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
37KB

MD5
fd2319aed9fe376159f11acabc94d87e

SHA1
541a86bad76ca23749dfe99ee9192130c3d48e7f

SHA256
02d72a5303330191e965ef252704f02a07be5a21e236aa676bb4fe8a2ceae947

SHA512
ab7f608237db2e1232d18665b8fdbcb4425f8ed99675b949a62a4f34ccc0fa9e8e63c81673a681a2f2fb0b6aef2a0340e7cdac18c2a685be1595fbadadf95dcc

Download Submit