Analysis

  • max time kernel
    144s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 01:18

General

  • Target

    $SYSDIR/$SYSDIR/$_14_.exe

  • Size

    47KB

  • MD5

    31351d9a63bd5bf7a486aaac8fde38d4

  • SHA1

    3cb292702c0f2454eadb97dfa440a30d7e10e236

  • SHA256

    8d39dbde3f97733cfd3a37201aef59264b9c8cf6520b13442a7ebb490ad2d726

  • SHA512

    63b88e44bcfc4e004430829222314e221d2dd7074ef82d23cf1a5703e1b1dca88e61021229b714dd11dde83246b52847178dca6318bbe1065cbb598b2a07ed3f

  • SSDEEP

    768:CCloVlpQE2MQGc6rDh84nSwN15G4DRF/O71mJ3JRnAB/qspezGXDcWu83l/:TYpQtMDc6fnpumJAB/qsjD+8p

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_14_.exe
    "C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_14_.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsdD4A0.tmp\validate.ini

    Filesize

    530B

    MD5

    1401d373cf497be2a795b81d1d2d1ebf

    SHA1

    f2ea33e8f873ad8bec4b5733a25940ed8e17b213

    SHA256

    6754368cea67ba90e3e0224f5cdaad4f4e93aa6a14390785f9b7bd264410313e

    SHA512

    4891dfe2a9ab4dbbf37ccb92683e5969d6fc3991ffff7b89b7f82b20f4cc4fd16cef0f95c741c032150012a3582fd7c54a1a8ad064acb78d705e3b00267cf583

  • C:\Users\Admin\AppData\Local\Temp\nsdD4A0.tmp\validate.ini

    Filesize

    457B

    MD5

    3dd555b3a8e68c3d96799200e70bfa06

    SHA1

    acbc9af8b616ffb6af53024a56155453f422651a

    SHA256

    65e4903c62e127083a55ab76914b2cc1b54953d2a94b061b855d78757c3f4e17

    SHA512

    992cc9b18d754b44ffd14313338def5d1a002054761f9e1c25d06f918279330b9332a2071b3dff8734fdf8d490c967334f58f1aade641ef637cd46c4c5358155

  • C:\Users\Admin\AppData\Local\Temp\nsdD4A0.tmp\validate.ini

    Filesize

    509B

    MD5

    6f19d0a4569a1370118dae6a4074cce7

    SHA1

    32f342bfbe08829479c11e892f21382e1bc9de37

    SHA256

    b6c34fcd3c1e74398fb419df430fac1b70599ea84079deb192618aee0f7049a0

    SHA512

    3793ddaa1d7fbee5508959f053091a3c66bf005391963644043d2161941434e638c935f4f6a1e9fa36a19aea7252206da7dd44464ee3b12d9ada151d7e293ad1

  • \Users\Admin\AppData\Local\Temp\nsdD4A0.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    eef9e469e8a30717974499f277d97e2a

    SHA1

    2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    SHA256

    1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    SHA512

    d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

  • \Users\Admin\AppData\Local\Temp\nsdD4A0.tmp\System.dll

    Filesize

    11KB

    MD5

    c6f5b9596db45ce43f14b64e0fbcf552

    SHA1

    665a2207a643726602dc3e845e39435868dddabc

    SHA256

    4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

    SHA512

    8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    47KB

    MD5

    31351d9a63bd5bf7a486aaac8fde38d4

    SHA1

    3cb292702c0f2454eadb97dfa440a30d7e10e236

    SHA256

    8d39dbde3f97733cfd3a37201aef59264b9c8cf6520b13442a7ebb490ad2d726

    SHA512

    63b88e44bcfc4e004430829222314e221d2dd7074ef82d23cf1a5703e1b1dca88e61021229b714dd11dde83246b52847178dca6318bbe1065cbb598b2a07ed3f