3c3c4b39f9355765dc75b7a893bbe52469f83afb9e5d609b7b74d9edfa415609

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:48

Target

$1/$OUTDIR/sftp_plugin/tc_sftp_uninstaller.exe
Size

59KB
MD5

e04b1bbeaff6221daf4d4ae0ed7fd00c
SHA1

cbe6a9e349a6711dc9e040e15ec32345c1bb7aee
SHA256

36b1104781e2c77a1e76593e697ac99621f27db3bfd5c282f7ae3579bf510a5b
SHA512

2f8523b1fd5bed682dc841292a5523eabbd49fea71b1e088a5080c375ed8e67b22e95e60129516d96bd720845a1c27fd37fd993d1cadfd81296176f683066334
SSDEEP

768:j9qjtOoh/pZbvc+HX+fFXSJA/mIj6qkzry8F9zGPVzISJRnHzioSe4bU/iXAB8+O:j0joUxZbE+HOI66qkryz9zIMipGVW3

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

1164 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1164	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

tc_sftp_uninstaller.exe

description	pid	process	target process
PID 1760 wrote to memory of 1164	1760	tc_sftp_uninstaller.exe	Au_.exe
PID 1760 wrote to memory of 1164	1760	tc_sftp_uninstaller.exe	Au_.exe
PID 1760 wrote to memory of 1164	1760	tc_sftp_uninstaller.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\$1\$OUTDIR\sftp_plugin\tc_sftp_uninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\$1\$OUTDIR\sftp_plugin\tc_sftp_uninstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$1\$OUTDIR\sftp_plugin\
2⤵
- Executes dropped EXE
PID:1164

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Filesize
59KB

MD5
e04b1bbeaff6221daf4d4ae0ed7fd00c

SHA1
cbe6a9e349a6711dc9e040e15ec32345c1bb7aee

SHA256
36b1104781e2c77a1e76593e697ac99621f27db3bfd5c282f7ae3579bf510a5b

SHA512
2f8523b1fd5bed682dc841292a5523eabbd49fea71b1e088a5080c375ed8e67b22e95e60129516d96bd720845a1c27fd37fd993d1cadfd81296176f683066334

Download Submit