7b4f0026de0ae5880ddb853725015d617a17f4405de54fa009d18ec020150cd3

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uRage 186054 Gaming MouseSETUP.exe
Size

28.7MB
MD5

b836315ca399b8825f786aa7f2d6f8a1
SHA1

d9542690686bf4592553a6295de7ef39538178da
SHA256

7b4f0026de0ae5880ddb853725015d617a17f4405de54fa009d18ec020150cd3
SHA512

5827dd63cec456311057e77c19f1608d0bbf73bc88e756c015ba693856fa8d865b5dd0dc5746b2cb446070fa0dcf44ebeaafbe8b473b54b4a83c056ae8544575
SSDEEP

786432:Aar92oW6zOp9cwrB54J2Ni2HOxK9OPHR3VGDHKkzfWAECWoy50D:NYoNzeLBOY8JKo1VGDHKoioy5c

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2484	uRage 186054 Gaming MouseSETUP.exe
2484	uRage 186054 Gaming MouseSETUP.exe
2484	uRage 186054 Gaming MouseSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uRage 186054 Gaming MouseSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	uRage 186054 Gaming MouseSETUP.exe

C:\Users\Admin\AppData\Local\Temp\uRage 186054 Gaming MouseSETUP.exe
"C:\Users\Admin\AppData\Local\Temp\uRage 186054 Gaming MouseSETUP.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso8241.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8241.tmp\nsNiuniuSkin.dll

Filesize
896KB

MD5
1834fd72e6a7387749d014a30b53d6ac

SHA1
e6c51f9f578e86e376501fc08f6d80cfe11bdb52

SHA256
148cb136ff5ae9711ddb869b5f22065ee89e13eaf5081ce39c07dbe89ccd97b7

SHA512
c8247a7916c718311a0f458cbb2133d77e3950609bb2c4b9470a9a7725a1d4d595422fb8c3c42f34629fd045675c72b221fee26a5188b9df4a0f3099857ec204

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8241.tmp\skin.zip

Filesize
249KB

MD5
abd21084878d113757c916be39aec58c

SHA1
5e4725eb857d9f3edfb8835948649898f3c16458

SHA256
a736835ba2d82ba0cfb5c3ac705045b9b3d245316e7d36dfeb26757e12d9f3a8

SHA512
9e1feadcbb79a2ac304f0df86bf593a3dd619ddfe3a731608917726110cc2d0743a1405a79932d1ddd127278311268774773ecac94cb5300e5f15c0f2c6fd0b8

Download Submit