43db744b91e2fdf747fc2ec683274d830caa377118554492acf4a9425df07dc0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall.exe
Size

61KB
MD5

4987901341ae4b24ffbe72b209d12552
SHA1

f90e164d64feb45ed324e3cc13ffa6ab1481937d
SHA256

89146d1df6ac73353d3408afc3ccaf6b303f5df1af4b44aaa45cb800e7998ce7
SHA512

493d30b4d968f2d4393cd288f7150331c5c7b9cebbbde0e277d5b6f1b7c3f7c6d8664eb76f9aeac9af4dcebb5730a893f55fb6a99d9246a6718ab631f97ee535
SSDEEP

1536:M42cPHBg5mVXkJ+qAELVigJD2x8J71LFPtrz:M42U65mXkJxAI0qZ7Dtrz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
444	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
444	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral22/files/0x00070000000234b7-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 444	944	uninstall.exe	87
PID 944 wrote to memory of 444	944	uninstall.exe	87
PID 944 wrote to memory of 444	944	uninstall.exe	87

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd8E67.tmp\InstallOptions.dll

Filesize
13KB

MD5
d765c492c21689e3d9d61634371fd861

SHA1
ac200933671ae52c9d5544d0e2e8e9144d286c83

SHA256
551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

SHA512
9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd8E67.tmp\UninstCustomPage

Filesize
674B

MD5
a23850e78bf8982e9ebe7ebb099576c6

SHA1
83d987ab5503cef8600eea19838bd00f2cef41c4

SHA256
15695e9b4957e4bc9075338200ba08602d3ee5fc30349e0a67193315957c7f2d

SHA512
8b048a33a5513dc13714d1444a0a90f7dd10828a8baa237973a318777868909fb61d0ef003b7ace606fefd0c8b087a7d8f10a7dfd8973348b9b58fbe09b872b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
61KB

MD5
4987901341ae4b24ffbe72b209d12552

SHA1
f90e164d64feb45ed324e3cc13ffa6ab1481937d

SHA256
89146d1df6ac73353d3408afc3ccaf6b303f5df1af4b44aaa45cb800e7998ce7

SHA512
493d30b4d968f2d4393cd288f7150331c5c7b9cebbbde0e277d5b6f1b7c3f7c6d8664eb76f9aeac9af4dcebb5730a893f55fb6a99d9246a6718ab631f97ee535

Download Submit