Analysis

  • max time kernel
    134s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 05:43

General

  • Target

    $PROGRAMFILES/Toggle Downloader/Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)/$PROG.exe

  • Size

    863KB

  • MD5

    27ecbaf65445d559b5fe36fc9db2fb4f

  • SHA1

    3a121e2f920406c91d5293e090ba63b49d81cf55

  • SHA256

    eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6

  • SHA512

    1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264

  • SSDEEP

    12288:hCzd7N7otPKnsvAH6x0GbQP3XoIq5tLgVHkCAQlvtrN:hCzFvnsm6iGbQ/oIKikelvj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)\$PROG.exe
    "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)\$PROG.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3484
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,16856304285138459032,14480077487839828721,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
    1⤵
      PID:4320

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsdDAE0.tmp\InstallOptions.dll

      Filesize

      14KB

      MD5

      325b008aec81e5aaa57096f05d4212b5

      SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

      SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

      SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • C:\Users\Admin\AppData\Local\Temp\nsdDAE0.tmp\ioSpecial.ini

      Filesize

      610B

      MD5

      4caa05affdb15d4eec35a8073c5f0cd8

      SHA1

      04d90d9d722d480be9171905435e75efe73476cb

      SHA256

      df8602b79b38ce27969dde594f626ea14029b5282561eea7c9d7f63f81f8fe2f

      SHA512

      a5044c46d045517461942fd1c3ef78e51a9467e22f19bf80e99f7112ccfa46a9027280416c9e20d791dcfda2d30ee3d2d2163df58b312eceff53d91dd2baa424

    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

      Filesize

      863KB

      MD5

      27ecbaf65445d559b5fe36fc9db2fb4f

      SHA1

      3a121e2f920406c91d5293e090ba63b49d81cf55

      SHA256

      eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6

      SHA512

      1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264