7b4f0026de0ae5880ddb853725015d617a17f4405de54fa009d18ec020150cd3

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninst.exe
Size

1.0MB
MD5

62649af0492d6848a9d0a3cc4ccd4f19
SHA1

a2c526e7fd51a5c5d3d8fd8245137ae4baea2451
SHA256

99c05d96fa431ad6a8bbb0cf67e7e07b763e83efabbc393719d6bf757ed34494
SHA512

4c46b42e43073a02c3648fe27809e2baeb22b8bd2cdd803098a5bcf6582f237bb26b4db2a54058cfbf6cf63ec03ef317379410fec4ffbeb4c54f0c290d3a23d9
SSDEEP

24576:sZFIqzK+Whkw2htdPRtpUhyiqxA+xSEox3MP9d+8:Ld+JwQRtpUhex3douPJ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2932	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
2932	Au_.exe
2932	Au_.exe
2932	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2932	Au_.exe
2932	Au_.exe
2932	Au_.exe
2932	Au_.exe
2932	Au_.exe
2932	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2932	836	uninst.exe	84
PID 836 wrote to memory of 2932	836	uninst.exe	84
PID 836 wrote to memory of 2932	836	uninst.exe	84

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsnA682.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA682.tmp\nsNiuniuSkin.dll

Filesize
896KB

MD5
1834fd72e6a7387749d014a30b53d6ac

SHA1
e6c51f9f578e86e376501fc08f6d80cfe11bdb52

SHA256
148cb136ff5ae9711ddb869b5f22065ee89e13eaf5081ce39c07dbe89ccd97b7

SHA512
c8247a7916c718311a0f458cbb2133d77e3950609bb2c4b9470a9a7725a1d4d595422fb8c3c42f34629fd045675c72b221fee26a5188b9df4a0f3099857ec204

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA682.tmp\nsProcess.dll

Filesize
4KB

MD5
88d3e48d1c1a051c702d47046ade7b4c

SHA1
8fc805a8b7900b6ba895d1b809a9f3ad4c730d23

SHA256
51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257

SHA512
83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA682.tmp\skin.zip

Filesize
249KB

MD5
abd21084878d113757c916be39aec58c

SHA1
5e4725eb857d9f3edfb8835948649898f3c16458

SHA256
a736835ba2d82ba0cfb5c3ac705045b9b3d245316e7d36dfeb26757e12d9f3a8

SHA512
9e1feadcbb79a2ac304f0df86bf593a3dd619ddfe3a731608917726110cc2d0743a1405a79932d1ddd127278311268774773ecac94cb5300e5f15c0f2c6fd0b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.0MB

MD5
62649af0492d6848a9d0a3cc4ccd4f19

SHA1
a2c526e7fd51a5c5d3d8fd8245137ae4baea2451

SHA256
99c05d96fa431ad6a8bbb0cf67e7e07b763e83efabbc393719d6bf757ed34494

SHA512
4c46b42e43073a02c3648fe27809e2baeb22b8bd2cdd803098a5bcf6582f237bb26b4db2a54058cfbf6cf63ec03ef317379410fec4ffbeb4c54f0c290d3a23d9

Download Submit
memory/2932-10-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download