e9d67a2e057ca30600aa7c21e7026844238265755fc03f78a4fb78f7d0e48883

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/desinst_rural.exe
Size

76KB
MD5

def2c0a4792cc5ef0215950fc1643c56
SHA1

994bf0c93774cdad39f0ba1c6f917fd5ac01f6a5
SHA256

dc2898bbc1836e658163e1fc5eb937a7f3234e68cf7fe84dd03e3d418c5adc8f
SHA512

545356418d3e1fc04edf189420575aa205b78ae0986652d2d981e8511e497f1e45159a446d6075a0b80de489e2e04ea7e65a5195dd4d3da1546f0152902bab43
SSDEEP

1536:tUqBWUSFNrdN90DukJbu6RmpcMUHgSo0M++tQmT/xTH2xt7:yGW3B+DukJbuJhUA3t1DxTH8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2392 Au_.exe
Loads dropped DLL 5 IoCs

Processes:

desinst_rural.exeAu_.exe

pid process

1028 desinst_rural.exe
2392 Au_.exe
2392 Au_.exe
2392 Au_.exe
2392 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2392	Au_.exe

pid	process
1028	desinst_rural.exe
2392	Au_.exe
2392	Au_.exe
2392	Au_.exe
2392	Au_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

desinst_rural.exeAu_.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	desinst_rural.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Au_.exe

pid process

2392 Au_.exe

pid	process
2392	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

desinst_rural.exe

description	pid	process	target process
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe
PID 1028 wrote to memory of 2392	1028	desinst_rural.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\desinst_rural.exe
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\desinst_rural.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\ioSpecial.ini

Filesize
685B

MD5
80f744dbd707211d092aea690994fd7f

SHA1
f1791a903fbc8cf6c03e31c3a47937133d3d19c8

SHA256
b6c42948487f435dd0d76c4253b4f65bb3c7237a67f9bf5535c96c8d73779c03

SHA512
439155f73ebca73182fe14ecf7323de435d1ab0295802c98422ee028be9b04b68e186ac7ad7db6b1f780f97fd6528599f14acef05d20143f3e92736e6f17691f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB06C.tmp\ioSpecial.ini

Filesize
724B

MD5
09abcb93d3a7673517a32733cb56fbbf

SHA1
21447e798b5bf5f18ef862b7c961c79aeaaedf8a

SHA256
078585a0ac49204cb44ba316fe54187b17ed7fe7f16f24bb9773a9c60ebf4f2b

SHA512
ba20553c7f887996964909dbf1e7c314fdad2fbab459f951357c2da6902c6ee1f4ac7c6ee1e5aadb86b4d1046bed4e00cf87ff3b00d58b8b0f9c4dc7a180a4e6

Download Submit
\Users\Admin\AppData\Local\Temp\nstB06C.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
76KB

MD5
def2c0a4792cc5ef0215950fc1643c56

SHA1
994bf0c93774cdad39f0ba1c6f917fd5ac01f6a5

SHA256
dc2898bbc1836e658163e1fc5eb937a7f3234e68cf7fe84dd03e3d418c5adc8f

SHA512
545356418d3e1fc04edf189420575aa205b78ae0986652d2d981e8511e497f1e45159a446d6075a0b80de489e2e04ea7e65a5195dd4d3da1546f0152902bab43

Download Submit