01902c9f0201c3a74b7400324558cf9580057e202c73c097a240bdb90998c7a2

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/$_1_.exe
Size

49KB
MD5

8b81f3c495662f93b54688be1e8b9040
SHA1

a6bd1b5a430fa821d36ebe04a1a0358d4a598cf1
SHA256

3c1d16bc1dcff51f594de3d2724048cda05182a8d0ac176dcabeaf378df3c520
SHA512

ae61ab02501285e0c6f136d7f5bef2cfd0c2dc48f0fc9274482943b1df8919c41fe65ff768a30aa32cae1ef65739cb86311010ce9cb9f29c01f1b969ef660b93
SSDEEP

768:uHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJWJRn25c7XF3pm0Efh:upgpHzb9dZVX9fHMvG0D3XJn5cjVSf2A

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2632	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
2724	$_1_.exe
2632	Au_.exe
2632	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$_1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral5/files/0x002b00000001866f-2.dat	nsis_installer_1
behavioral5/files/0x002b00000001866f-2.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2632	2724	$_1_.exe	30
PID 2724 wrote to memory of 2632	2724	$_1_.exe	30
PID 2724 wrote to memory of 2632	2724	$_1_.exe	30
PID 2724 wrote to memory of 2632	2724	$_1_.exe	30

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$_1_.exe
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$_1_.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$SYSDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse5C36.tmp\validate.ini

Filesize
457B

MD5
5dc06d1fa9ef3924b3ee7f5f06cf367f

SHA1
4bf5600c62713ab9f0ffb2829a79534a332b5cbb

SHA256
03721723ee11a2d186840f60cfd7a4356b9186b21ebbb3bce459829da495507c

SHA512
3fb9926df15803ae1a77fcd169e8e9ef610a0e138afc47ba3532cff63e660053f65925c62c2c654e6dc887b0e9cc821a62c939f10da87304d6561c673219eb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5C36.tmp\validate.ini

Filesize
509B

MD5
ca6f876de11523449fd756ad88e74f97

SHA1
c0a582c4b86dd3f85dde91bef2115961ba9ef1f3

SHA256
6bd2d3932bf1e76db367166cbf5343f5bade13e30dfc36400670d438da325e0e

SHA512
9f69efd9b80c570dc3a6f55d021270d29984eb1fce6f9d0d695ad2a6a93731a9fd0d0750d063a61a6b7e19aa6219339489265585f483e3e5bd10c90bd72eb9d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5C36.tmp\validate.ini

Filesize
530B

MD5
e3fa21279b7dd0d70145143a00d80f60

SHA1
d2aa6955a7e9d40882d371f11c2821774b992d50

SHA256
f47a89d5e87eca958cf192a29cdf68425a244e6c588559aa2ee3186e9ba0965e

SHA512
8a7d2e2d72ff3e210662152f0538930d5fea1b606e3f0b234ac56d97336cbd825cf0ca0465c9c1f5133cf63747f8892074090168aa3c6923c6471109bacc19fd

Download Submit
\Users\Admin\AppData\Local\Temp\nse5C36.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nse5C36.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
49KB

MD5
8b81f3c495662f93b54688be1e8b9040

SHA1
a6bd1b5a430fa821d36ebe04a1a0358d4a598cf1

SHA256
3c1d16bc1dcff51f594de3d2724048cda05182a8d0ac176dcabeaf378df3c520

SHA512
ae61ab02501285e0c6f136d7f5bef2cfd0c2dc48f0fc9274482943b1df8919c41fe65ff768a30aa32cae1ef65739cb86311010ce9cb9f29c01f1b969ef660b93

Download Submit