daea50d36b20ac0e2d01aa71ff3e02b2fa1cd819d0a77d65e58ce7e3df902532

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/$SYSDIR/$_14_.exe
Size

47KB
MD5

31351d9a63bd5bf7a486aaac8fde38d4
SHA1

3cb292702c0f2454eadb97dfa440a30d7e10e236
SHA256

8d39dbde3f97733cfd3a37201aef59264b9c8cf6520b13442a7ebb490ad2d726
SHA512

63b88e44bcfc4e004430829222314e221d2dd7074ef82d23cf1a5703e1b1dca88e61021229b714dd11dde83246b52847178dca6318bbe1065cbb598b2a07ed3f
SSDEEP

768:CCloVlpQE2MQGc6rDh84nSwN15G4DRF/O71mJ3JRnAB/qspezGXDcWu83l/:TYpQtMDc6fnpumJAB/qsjD+8p

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2236	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
2236	Au_.exe
2236	Au_.exe
2236	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$_14_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral6/files/0x00070000000234e6-4.dat	nsis_installer_1
behavioral6/files/0x00070000000234e6-4.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 2236	464	$_14_.exe	81
PID 464 wrote to memory of 2236	464	$_14_.exe	81
PID 464 wrote to memory of 2236	464	$_14_.exe	81

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_14_.exe
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_14_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstC314.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC314.tmp\System.dll

Filesize
11KB

MD5
c6f5b9596db45ce43f14b64e0fbcf552

SHA1
665a2207a643726602dc3e845e39435868dddabc

SHA256
4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

SHA512
8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC314.tmp\validate.ini

Filesize
457B

MD5
692703c7a0d667c69c7dfe2b138982aa

SHA1
db3c2f9f5ed307a7b9c7608f564b2bf0097c1258

SHA256
df11f7117c4fd9b4571b38bfe4ef1c5c2b0a94b24f25b34df50f01b86fc8e9d7

SHA512
3fda09946568453375f25c5f0db0e779bada3ee2b60a89bded4a3091e27e399f1d8c301823f77496507fad635430790dc541a150941d795f937436af1487e4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC314.tmp\validate.ini

Filesize
530B

MD5
8b40c3dd30fdcdd7246de97d15eac1b7

SHA1
1bab6664c1160937c8545dd55607ae16a0ac9619

SHA256
82997e61150875c5109b7dd35bfff4c91c4d6f84d63cece733bdef81f81fa119

SHA512
91fe430ec653b553b9264acd61f276f84372db5b09f8d937614ef0b2ee358dab0e00713c29c9e1c17c9f9ce43f16f7ca21b1c8f4164d72044f99efd8bbf3b74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
47KB

MD5
31351d9a63bd5bf7a486aaac8fde38d4

SHA1
3cb292702c0f2454eadb97dfa440a30d7e10e236

SHA256
8d39dbde3f97733cfd3a37201aef59264b9c8cf6520b13442a7ebb490ad2d726

SHA512
63b88e44bcfc4e004430829222314e221d2dd7074ef82d23cf1a5703e1b1dca88e61021229b714dd11dde83246b52847178dca6318bbe1065cbb598b2a07ed3f

Download Submit