e9d67a2e057ca30600aa7c21e7026844238265755fc03f78a4fb78f7d0e48883

Analysis

max time kernel
137s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/desinst_rural.exe
Size

76KB
MD5

def2c0a4792cc5ef0215950fc1643c56
SHA1

994bf0c93774cdad39f0ba1c6f917fd5ac01f6a5
SHA256

dc2898bbc1836e658163e1fc5eb937a7f3234e68cf7fe84dd03e3d418c5adc8f
SHA512

545356418d3e1fc04edf189420575aa205b78ae0986652d2d981e8511e497f1e45159a446d6075a0b80de489e2e04ea7e65a5195dd4d3da1546f0152902bab43
SSDEEP

1536:tUqBWUSFNrdN90DukJbu6RmpcMUHgSo0M++tQmT/xTH2xt7:yGW3B+DukJbuJhUA3t1DxTH8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4872	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
4872	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	desinst_rural.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral16/files/0x000800000002361d-3.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4872	540	desinst_rural.exe	92
PID 540 wrote to memory of 4872	540	desinst_rural.exe	92
PID 540 wrote to memory of 4872	540	desinst_rural.exe	92

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\desinst_rural.exe
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\desinst_rural.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu5214.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5214.tmp\ioSpecial.ini

Filesize
685B

MD5
6d2841654667f0eb55fe5960a93004a8

SHA1
149a656edc474f569f1170795b73e58622ed6a2d

SHA256
24acf7c9bcf11a737114c10ff380981a5321303eba2ee60f84f02b9808283a18

SHA512
5053f0382b6feb67d36f9aeed22dca6e97b27be88d6fcfe4458983100e152e6516273f19b9ab476f7d04ee04fa54cd857c5034c0c7707f58255a1528ae5fa92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
76KB

MD5
def2c0a4792cc5ef0215950fc1643c56

SHA1
994bf0c93774cdad39f0ba1c6f917fd5ac01f6a5

SHA256
dc2898bbc1836e658163e1fc5eb937a7f3234e68cf7fe84dd03e3d418c5adc8f

SHA512
545356418d3e1fc04edf189420575aa205b78ae0986652d2d981e8511e497f1e45159a446d6075a0b80de489e2e04ea7e65a5195dd4d3da1546f0152902bab43

Download Submit