Overview
overview
10Static
static
10_Getintopc...64.rar
windows11-21h2-x64
3Password 123.txt
windows11-21h2-x64
3Sausage.Fa...60.sfv
windows11-21h2-x64
3Sausage.Fa...up.exe
windows11-21h2-x64
10$PLUGINSDI...gm.ogg
windows11-21h2-x64
3$PLUGINSDI...in.skf
windows11-21h2-x64
3$PLUGINSDI...al.ini
windows11-21h2-x64
3$PLUGINSDI...rd.bmp
windows11-21h2-x64
3$PLUGINSDI...sh.bmp
windows11-21h2-x64
Resource/1.bmp
windows11-21h2-x64
3Resource/10.bmp
windows11-21h2-x64
3Resource/11.bmp
windows11-21h2-x64
3Resource/12.bmp
windows11-21h2-x64
3Resource/13.bmp
windows11-21h2-x64
3Resource/14.bmp
windows11-21h2-x64
3Resource/15.bmp
windows11-21h2-x64
3Resource/16.bmp
windows11-21h2-x64
3Resource/2.bmp
windows11-21h2-x64
3Resource/3.bmp
windows11-21h2-x64
3Resource/4.bmp
windows11-21h2-x64
3Resource/5.bmp
windows11-21h2-x64
3Resource/6.bmp
windows11-21h2-x64
3Resource/7.bmp
windows11-21h2-x64
3Resource/8.bmp
windows11-21h2-x64
3Resource/9.bmp
windows11-21h2-x64
3Resource/AboutBox.bmp
windows11-21h2-x64
3Resource/B...nd.bmp
windows11-21h2-x64
3Resource/S...32.dll
windows11-21h2-x64
3Resource/S...64.dll
windows11-21h2-x64
1Sausage Fa...64.dll
windows11-21h2-x64
1Sausage Fattener.dll
windows11-21h2-x64
1uninstall.exe
windows11-21h2-x64
7Analysis
-
max time kernel
210s -
max time network
278s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-07-2024 10:48
Behavioral task
behavioral1
Sample
_Getintopc.com_Sausage.Fattener.VST.v1.0.x86.x64.rar
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
Password 123.txt
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
Sausage.Fattener.VST.v1.0.x86.x64/Sausage.Fattener.VST.v1.0.x86.x64/asgn1160.sfv
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
Sausage.Fattener.VST.v1.0.x86.x64/Sausage.Fattener.VST.v1.0.x86.x64/setup.exe
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/dat_bgm.ogg
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/dat_skin.skf
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/splash.bmp
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
Resource/1.bmp
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
Resource/10.bmp
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
Resource/11.bmp
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
Resource/12.bmp
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
Resource/13.bmp
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
Resource/14.bmp
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
Resource/15.bmp
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Resource/16.bmp
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Resource/2.bmp
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Resource/3.bmp
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Resource/4.bmp
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Resource/5.bmp
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Resource/6.bmp
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Resource/7.bmp
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Resource/8.bmp
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Resource/9.bmp
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Resource/AboutBox.bmp
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Resource/Background.bmp
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Resource/Sausage Fattener 32.dll
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Resource/Sausage Fattener 64.dll
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Sausage Fattener x64.dll
Resource
win11-20240709-en
Behavioral task
behavioral31
Sample
Sausage Fattener.dll
Resource
win11-20240709-en
Behavioral task
behavioral32
Sample
uninstall.exe
Resource
win11-20240709-en
General
-
Target
uninstall.exe
-
Size
38KB
-
MD5
4d80cf1dcb4050035ababe91073376ed
-
SHA1
66479ddbc4426fb45a526d7a6fb1df1ad09eedde
-
SHA256
09511049b3b5d519bd9ad7fffe29fbae5bde288364e69cff6490a64d6e4f601e
-
SHA512
972bddb89968cb422c6e35aad471b3ca262a40169ff624a207d5a4053efd211251fa04f6381a34230163d0a22239897e751b24dbfa8390444ffe77b7d3c261cb
-
SSDEEP
768:c4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJ3Tc8F1:PLXB65939tY6HBg4sXJ3TJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 3904 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
uninstall.exedescription pid process target process PID 784 wrote to memory of 3904 784 uninstall.exe Au_.exe PID 784 wrote to memory of 3904 784 uninstall.exe Au_.exe PID 784 wrote to memory of 3904 784 uninstall.exe Au_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
PID:3904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD54d80cf1dcb4050035ababe91073376ed
SHA166479ddbc4426fb45a526d7a6fb1df1ad09eedde
SHA25609511049b3b5d519bd9ad7fffe29fbae5bde288364e69cff6490a64d6e4f601e
SHA512972bddb89968cb422c6e35aad471b3ca262a40169ff624a207d5a4053efd211251fa04f6381a34230163d0a22239897e751b24dbfa8390444ffe77b7d3c261cb