Analysis
-
max time kernel
103s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
16-06-2024 09:10
General
-
Target
$PLUGINSDIR/uninstall.exe
-
Size
8.1MB
-
MD5
8f38aa72cd18800c5d32b28f382f3992
-
SHA1
7c5ce2b711df4b1750a27c40b0f22bc3f1c7afe5
-
SHA256
f52158db0772365ed95657471fe5519838c01bc7e4dfb7b00f5fb68fd5320a8d
-
SHA512
cc2d10d3d8ea670d2ad2955388ab260f7c87c0a70ce2ad815cd3a041eae994131dd4e97c8d15fc515e7abe963f6a5d566fb84322b6eaf36971f09248bcc2e289
-
SSDEEP
196608:5Y18/QDobE0TSkJzTtpQF6ZBPTS8y5BFwGIR6ip2eyWzi+8LX+1ZxWc:5+8/1EglTvS+S897pgGiNLeZxv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe" "av:1.0.1" "gv:1.0.1.1" "gs:Official-de" "gi:UA-85655135-28" "an:DroidKit" "c:iMobie"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5d8fca35ff95fe00a7174177181f8bd13
SHA1fbafea4d2790dd2c0d022dfb08ded91de7f5265e
SHA256ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
SHA512eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
7.4MB
MD5839640ba4c87b4a0fbd4d81fc54f8f51
SHA10fdf3cf3685de715f8206400a232bf389ce319d6
SHA25658b8642b2665efde3974c18c2613b6e27dcf31fbb4b048339f93b2019c26d6df
SHA51214b97fd80c8b58422949b9d8db2660e93c6ee7c41873e8388cc9b62396e791f346346465527088a50a58d6d9a358e21a8652a0934149dd6ed3947841a7e59354
-
Filesize
128KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
7.5MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB