Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 00:41

General

  • Target

    $3/$APPDATA/TablacusApp/uninstaller.exe

  • Size

    39KB

  • MD5

    418b6ce751cb8033e9db8100c6aa309c

  • SHA1

    5651821f8d127f5dca458625f26d05cc55cc5c9d

  • SHA256

    1514e7d29c02443910fdbf4f4af6637a415304ceb3f34d53dbb1663571e1e2a9

  • SHA512

    eca359e568300e16382a0b9c6cefc443d2cdd055c333e54a05b50c9185c50b5dedff5f824ffc4cde2533fd150bec8747933c5a1667f59abd0abc01d9657b59de

  • SSDEEP

    768:2JKOdm9o29rJYypQJ2JQJXJuKU+duC1ZHQ0D3LHSGiVNuCJRnSb6Z:iTdm9B9lYypfMXvugHQ0DbLiNuhb6Z

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\TablacusApp\uninstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\TablacusApp\uninstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\TablacusApp\
      2⤵
      • Executes dropped EXE
      PID:3188

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

          Filesize

          39KB

          MD5

          418b6ce751cb8033e9db8100c6aa309c

          SHA1

          5651821f8d127f5dca458625f26d05cc55cc5c9d

          SHA256

          1514e7d29c02443910fdbf4f4af6637a415304ceb3f34d53dbb1663571e1e2a9

          SHA512

          eca359e568300e16382a0b9c6cefc443d2cdd055c333e54a05b50c9185c50b5dedff5f824ffc4cde2533fd150bec8747933c5a1667f59abd0abc01d9657b59de