1fd0eb5a0bde40999118afa7beb7e99d43ba60eeba41d3100c8af08c00dc3aa4

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

88KB
MD5

e10da989e7299ad0a37591649a676881
SHA1

66494a8c3093e9a4a6026c2ad29615c8f8be1a1c
SHA256

fa5493c2c562c3431083155b9184d6e5ca54307f550fa03863eebb409ed339ae
SHA512

7fa1e6b829024439377813f54ce0bda1be3858df525d83293f6065fe783fca2fcac8c74d3d6e08665ebc258aeb5764f24f18f1b2dc75fe061e459d15695c7d39
SSDEEP

1536:Rt/XUS3ZQ9h5f90D5kJWHR83dIWXwyNLIAW35pSkeVS9XaxIdPar:R1mh5CD5kJAR8zXnLIA8p3eVS9Xu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
1996	Au_.exe
1996	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral18/files/0x00070000000233f8-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1996	3836	Uninstall.exe	83
PID 3836 wrote to memory of 1996	3836	Uninstall.exe	83
PID 3836 wrote to memory of 1996	3836	Uninstall.exe	83

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsq3067.tmp\InstallOptions.dll

Filesize
12KB

MD5
3c19f79ce11facc2fc4d3351dbb263e0

SHA1
17f4bf4b18ea7700f70ac7d825dc997be0d25f71

SHA256
cfaba712ad640ce2b4890005ffcf03ed9e2a18a6cf9075295f3aaea1478896b9

SHA512
05c9ac861e4fed610171fcb5fad40abc30cbf90e9c7cb13c758f52cdff568af0fdd6af968db4fb143a748c77f21c353c7cffea28cbcbd2ad17157038ab490273

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq3067.tmp\System.dll

Filesize
10KB

MD5
725145e8caa39635cab9899c47c72eda

SHA1
30478c907551bd920bf359638b091fc5c10b5a53

SHA256
1759e4f7777fb8c9ed356a7d4dc237a90e0760061685d44ea02d40ca9e359ceb

SHA512
de31286ea10321f762a3b6e7c6c82177d5b6f45a82adc936fcbbc23105708cbbbec903ba94ba94e7723e80f1828393e5395ef575b37136b19de7535e74e24547

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq3067.tmp\ioSpecial.ini

Filesize
619B

MD5
9e8e5f826d612788077b83f9e75a7cfd

SHA1
76caafdaabe1dac8165ec964da8877b18d1bea1f

SHA256
f31457d01daebb6b25f85ffde0205c2f8734aa9062de241457b70f808425bb09

SHA512
eec28118123e1540257ddb2f90550b85d8422c69f1d21c742b8f27b573a664ea22063cce870d65a3da1406f1931b90a19b28a700710f47b1f374e193c9343918

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
88KB

MD5
e10da989e7299ad0a37591649a676881

SHA1
66494a8c3093e9a4a6026c2ad29615c8f8be1a1c

SHA256
fa5493c2c562c3431083155b9184d6e5ca54307f550fa03863eebb409ed339ae

SHA512
7fa1e6b829024439377813f54ce0bda1be3858df525d83293f6065fe783fca2fcac8c74d3d6e08665ebc258aeb5764f24f18f1b2dc75fe061e459d15695c7d39

Download Submit