Analysis
-
max time kernel
103s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04-08-2024 22:12
General
-
Target
$PLUGINSDIR/uninstall.exe
-
Size
8.1MB
-
MD5
b73940b9b108c8196600617a7f734d64
-
SHA1
f70aee50bcd93db0180ac0969126562882934bd4
-
SHA256
5bd33a6ba5e012c3e6f8ccc5ab322728d5df31e9e7b74daaf327aa54fc95028f
-
SHA512
ebd98143c766b12e12198ce8b310423cd6e4e638fca809afb006ff5953f65ee820b7140264bc93cbfe2f6015d4e00f26b696e7773ee55ad6da67baf5d973cc02
-
SSDEEP
196608:+l18/QDobE0TSkJzTtpQF6ZBPTS8y5BFwGIR6ip2eyWzi+8LX+1ZxWj:+H8/1EglTvS+S897pgGiNLeZxG
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe" "av:1.0.1" "gv:1.0.1.1" "gs:Official-com" "gi:UA-85655135-28" "an:DroidKit" "c:iMobie"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5d8fca35ff95fe00a7174177181f8bd13
SHA1fbafea4d2790dd2c0d022dfb08ded91de7f5265e
SHA256ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
SHA512eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
7.4MB
MD5839640ba4c87b4a0fbd4d81fc54f8f51
SHA10fdf3cf3685de715f8206400a232bf389ce319d6
SHA25658b8642b2665efde3974c18c2613b6e27dcf31fbb4b048339f93b2019c26d6df
SHA51214b97fd80c8b58422949b9d8db2660e93c6ee7c41873e8388cc9b62396e791f346346465527088a50a58d6d9a358e21a8652a0934149dd6ed3947841a7e59354
-
Filesize
128KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
7.5MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB