b057b1ec1c1656d951ba3a8ac6537ff683508cc94b7902cc4fc6e9ce844a2203

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 08:53

Target

$PROGRAMFILES/1ClickDownload/$PROGRAMFILES/1ClickDownload/uninst.exe
Size

58KB
MD5

4d269c5eaa08deadac45bb1be793edec
SHA1

f6b3b0e935f22af4e17f7750cdf1a34517457c87
SHA256

cb025e49fbe2fba64245dfec86ad1f50d0c601fb139e5e0c4c7e7f4998e73312
SHA512

3d01673826936578849af0b21f852882858206b172a8486679be4c8d9adfa6d42f31588779b1494cbe1657cc45d09956cdeed82b7fc20a5ff2780bb9af766229
SSDEEP

1536:lLXB65939tY6HBg4sXJWgdLeAyNDtAvs1eP/w4R:lLk395hYXJWceA0oP/wy

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4596	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
4596	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral16/files/0x00080000000234c7-3.dat	nsis_installer_1
behavioral16/files/0x00080000000234c7-3.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	Au_.exe
4596	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4596	4516	uninst.exe	84
PID 4516 wrote to memory of 4596	4516	uninst.exe	84
PID 4516 wrote to memory of 4596	4516	uninst.exe	84

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\1ClickDownload\$PROGRAMFILES\1ClickDownload\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\1ClickDownload\$PROGRAMFILES\1ClickDownload\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\1ClickDownload\$PROGRAMFILES\1ClickDownload\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nslC768.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
58KB

MD5
4d269c5eaa08deadac45bb1be793edec

SHA1
f6b3b0e935f22af4e17f7750cdf1a34517457c87

SHA256
cb025e49fbe2fba64245dfec86ad1f50d0c601fb139e5e0c4c7e7f4998e73312

SHA512
3d01673826936578849af0b21f852882858206b172a8486679be4c8d9adfa6d42f31588779b1494cbe1657cc45d09956cdeed82b7fc20a5ff2780bb9af766229

Download Submit