1067574fe5366f4755cd517f3e6caca89ac99ba2b3d56de3b4cecf94d8529824

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$1/$OUTDIR/sftp_plugin/tc_sftp_uninstaller.exe
Size

59KB
MD5

e04b1bbeaff6221daf4d4ae0ed7fd00c
SHA1

cbe6a9e349a6711dc9e040e15ec32345c1bb7aee
SHA256

36b1104781e2c77a1e76593e697ac99621f27db3bfd5c282f7ae3579bf510a5b
SHA512

2f8523b1fd5bed682dc841292a5523eabbd49fea71b1e088a5080c375ed8e67b22e95e60129516d96bd720845a1c27fd37fd993d1cadfd81296176f683066334
SSDEEP

768:j9qjtOoh/pZbvc+HX+fFXSJA/mIj6qkzry8F9zGPVzISJRnHzioSe4bU/iXAB8+O:j0joUxZbE+HOI66qkryz9zIMipGVW3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
1368	tc_sftp_uninstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3036	1368	tc_sftp_uninstaller.exe	28
PID 1368 wrote to memory of 3036	1368	tc_sftp_uninstaller.exe	28
PID 1368 wrote to memory of 3036	1368	tc_sftp_uninstaller.exe	28
PID 1368 wrote to memory of 3036	1368	tc_sftp_uninstaller.exe	28

C:\Users\Admin\AppData\Local\Temp\$1\$OUTDIR\sftp_plugin\tc_sftp_uninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\$1\$OUTDIR\sftp_plugin\tc_sftp_uninstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$1\$OUTDIR\sftp_plugin\
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
59KB

MD5
e04b1bbeaff6221daf4d4ae0ed7fd00c

SHA1
cbe6a9e349a6711dc9e040e15ec32345c1bb7aee

SHA256
36b1104781e2c77a1e76593e697ac99621f27db3bfd5c282f7ae3579bf510a5b

SHA512
2f8523b1fd5bed682dc841292a5523eabbd49fea71b1e088a5080c375ed8e67b22e95e60129516d96bd720845a1c27fd37fd993d1cadfd81296176f683066334

Download Submit