05e697efcba64236432c6e2a0d871fafefd00ac06b608cc096c38e85c2841495

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PROGRAMFILES/Toggle Downloader/Toggle Downloader Finale 2011/$PROGRAMFILES/Toggle Downloader/Toggle.exe
Size

863KB
MD5

27ecbaf65445d559b5fe36fc9db2fb4f
SHA1

3a121e2f920406c91d5293e090ba63b49d81cf55
SHA256

eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6
SHA512

1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264
SSDEEP

12288:hCzd7N7otPKnsvAH6x0GbQP3XoIq5tLgVHkCAQlvtrN:hCzFvnsm6iGbQ/oIKikelvj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4404	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
4404	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral22/files/0x000800000002325e-3.dat	nsis_installer_1
behavioral22/files/0x000800000002325e-3.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4404	5088	Toggle.exe	92
PID 5088 wrote to memory of 4404	5088	Toggle.exe	92
PID 5088 wrote to memory of 4404	5088	Toggle.exe	92

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Finale 2011\$PROGRAMFILES\Toggle Downloader\Toggle.exe
"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Finale 2011\$PROGRAMFILES\Toggle Downloader\Toggle.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Finale 2011\$PROGRAMFILES\Toggle Downloader\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk5F7.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk5F7.tmp\ioSpecial.ini

Filesize
609B

MD5
32d37443f49686a8dddaba396dc04638

SHA1
72c032d5987f7e8d04be0965e15b0319570382da

SHA256
598edab0e88bddebf7c82de7f9b6b666f7ca2e78dd3ceb6adb6bcd7aa8257d75

SHA512
303b227c14b6b0461c9a3c65983dabcc844bfba4c4727ccbe08bbd95fd7aca8a2bd16045520d351d6b52b1c6545c50e77088ea048f86b94f419d022ea9d18b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
863KB

MD5
27ecbaf65445d559b5fe36fc9db2fb4f

SHA1
3a121e2f920406c91d5293e090ba63b49d81cf55

SHA256
eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6

SHA512
1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264

Download Submit