64c42a19ca9ee836df4e48ad85298d700727019099aa85cdf1d995e298cc216c

Analysis

max time kernel
110s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

528b7359f57113a01d4438a528c130f0N.exe
Size

621KB
MD5

528b7359f57113a01d4438a528c130f0
SHA1

278e99d7c48c3fd2d69e368f067778e44726c962
SHA256

64c42a19ca9ee836df4e48ad85298d700727019099aa85cdf1d995e298cc216c
SHA512

6c014cd3ccb5f5621dd8c4343b9a72f2de235b5b6b3eefe4b7eb131d7a0ac0b44140723346390e8fb35ba6b58c8d891e5a4ad660d4a9d6f5354f4f0055e559b1
SSDEEP

12288:tTf9EIl/clAlRUDbvDyQ97TOX/O+Og3Rh0x6HtbxLAucSbldUrjCcZsiG:tTfhOAfMbvms7TO2+NFtPCycw

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1968	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1968	Au_.exe

Loads dropped DLL 47 IoCs

pid	Process
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe
1968	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	528b7359f57113a01d4438a528c130f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x00070000000234ac-4.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	Au_.exe
1968	Au_.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1968	2360	528b7359f57113a01d4438a528c130f0N.exe	84
PID 2360 wrote to memory of 1968	2360	528b7359f57113a01d4438a528c130f0N.exe	84
PID 2360 wrote to memory of 1968	2360	528b7359f57113a01d4438a528c130f0N.exe	84
PID 1968 wrote to memory of 1088	1968	Au_.exe	93
PID 1968 wrote to memory of 1088	1968	Au_.exe	93
PID 1968 wrote to memory of 1088	1968	Au_.exe	93

C:\Users\Admin\AppData\Local\Temp\528b7359f57113a01d4438a528c130f0N.exe
"C:\Users\Admin\AppData\Local\Temp\528b7359f57113a01d4438a528c130f0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u "C:\Users\Admin\AppData\Local\Temp\Additional Links.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Additional LinksUninstaller_1725607970.log

Filesize
739B

MD5
5f34b3ba9b08e5bc6e10c94d9cdb6449

SHA1
7b3fdffc7692c2f0ceef03201115da70b811950f

SHA256
4f09e394e4580f749513230a913b3d19dcdc39e04a14255043505f782a445129

SHA512
357b43469fcc79f473939f0c6b1193f46dfa0fcbf742ea62099fca67d8a42ddd719e4acee261da97e990a7cc02d5e71a337c9557c2e84c79273e24efd9ff9deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr9869.tmp\StdUtils.dll

Filesize
14KB

MD5
21010df9bc37daffcc0b5ae190381d85

SHA1
a8ba022aafc1233894db29e40e569dfc8b280eb9

SHA256
0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

SHA512
95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr9869.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr9869.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr9869.tmp\nsislog.dll

Filesize
42KB

MD5
e47100b70748fc790ffe6299cdf7ef2d

SHA1
ad2a9cd5f7c39121926b7c131816e7ba85aeead2

SHA256
271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

SHA512
88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr9869.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
621KB

MD5
528b7359f57113a01d4438a528c130f0

SHA1
278e99d7c48c3fd2d69e368f067778e44726c962

SHA256
64c42a19ca9ee836df4e48ad85298d700727019099aa85cdf1d995e298cc216c

SHA512
6c014cd3ccb5f5621dd8c4343b9a72f2de235b5b6b3eefe4b7eb131d7a0ac0b44140723346390e8fb35ba6b58c8d891e5a4ad660d4a9d6f5354f4f0055e559b1

Download Submit
memory/1968-17-0x00000000025B0000-0x00000000025C0000-memory.dmp

Filesize
64KB

Download
memory/1968-130-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/1968-138-0x0000000002610000-0x0000000002620000-memory.dmp

Filesize
64KB

Download
memory/1968-211-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2360-6-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download