1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninst.exe
Size 1.3MB
Sample240529-mqe7pace72
SHA256 0cefed9345b825dcef7f2b7685e72d0ddd94c6ba0c3c878ada8533e70d8e2171
MD5 b5db7f24798a0a3a19b6ca9b4732b4b6
SHA1 e4d3d5fec28e6b3e36b31c6ca20384fe42f0a760
SHA512 e93d8324e191bb84e6f58e968d6c024db92297f359c4ac4e732fe1123bcf478c4fd0c88e14e3eca555e31ed9c192a35becfa73ad6a773a50bb554ffc957ed888
SSDEEP 24576:zKICuTZzVwI0GSTuDTYJxaaGmLJS1cJTD2r7IVFgmTQENUryaq2ulTyIrFn5o5AV:XCAtV13STuDkJxaaGl1cUXIjgfhGTyS9
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1300	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
2220	uninst.exe
1300	Au_.exe
1300	Au_.exe
1300	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral19/files/0x0032000000014251-2.dat	nsis_installer_1
behavioral19/files/0x0032000000014251-2.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	Au_.exe
1300	Au_.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	Au_.exe
Token: SeDebugPrivilege	1300	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1300	2220	uninst.exe	28
PID 2220 wrote to memory of 1300	2220	uninst.exe	28
PID 2220 wrote to memory of 1300	2220	uninst.exe	28
PID 2220 wrote to memory of 1300	2220	uninst.exe	28

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nstCCE.tmp\System.dll
Size 11KB
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDui.dll

Path \Users\Admin\AppData\Local\Temp\nstCCE.tmp\nsDui.dll
Size 1.7MB
SHA256 adf2f657b39af4364df155ae84c1f8fddf863291f5ee7590856c6a4e96f148d3
MD5 9e5a90292bf4b832773f17bdf3b67f26
SHA1 4fedc3842c11e8c0053978dc0e23852fd5f6a910
SHA512 0ab78a1faa992e9b5d4312f32c778ffa7ef9e7b50f0eaf833e5a5798362618b2b8055bef39dbb3fa250f7ce5874844b047e5aafdab4b659b78e7170a5d64a3bf
SSDEEP 24576:OtljvGphGZy1WYRE01MvNvzLqC+I5LZDHIDoOtI4F7vTyBNUcMT2u5TyIsFn5o5e:OtBEt1402vfqFIxeI+7zSwTyD5g5mD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Au_.exe

Path \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 1.3MB
SHA256 0cefed9345b825dcef7f2b7685e72d0ddd94c6ba0c3c878ada8533e70d8e2171
MD5 b5db7f24798a0a3a19b6ca9b4732b4b6
SHA1 e4d3d5fec28e6b3e36b31c6ca20384fe42f0a760
SHA512 e93d8324e191bb84e6f58e968d6c024db92297f359c4ac4e732fe1123bcf478c4fd0c88e14e3eca555e31ed9c192a35becfa73ad6a773a50bb554ffc957ed888
SSDEEP 24576:zKICuTZzVwI0GSTuDTYJxaaGmLJS1cJTD2r7IVFgmTQENUryaq2ulTyIrFn5o5AV:XCAtV13STuDkJxaaGl1cUXIjgfhGTyS9
MD5 SHA1 SHA512 SSDEEP

Submit Download