Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 03:14

General

  • Target

    $0/uninstall.exe

  • Size

    78KB

  • MD5

    490071c63a8583c44546421214809399

  • SHA1

    f2268f3629b25b73b7f3ad984d867be01c19a670

  • SHA256

    8f75ba9703c28b460025e05615222ed2b31e5eed829bfbab30bb029e873c0c24

  • SHA512

    00301e21a10071a875b41ab8dbb715fad81af1c28f2badc8d2580b7b40ef52315fbd4af5e1e9a33c2070c3dc5c818632f0bed98f6e46d0869a3859997e12425b

  • SSDEEP

    1536:PEkjY1zy214Qay0DGkJ7qAELVigJGo5hcpw/1q792sX7Ia12/DY:8kjAJ4dDGkJ+AI0bo1qRka0/U

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\ioSpecial.ini

    Filesize

    703B

    MD5

    524912a0e6d6a54b9594f10b878b2d9e

    SHA1

    ce365aba889c75732c82a8901f1f7c32e8fbd8ef

    SHA256

    a1c9f078deea99c95cd996e3460cdccaad10b911b0a8f8edd2f7c1dce1d3acdc

    SHA512

    9439989d04911deee0b1b9f95e89b711a0e50ef320a7731d53db710ef79c0a579a20a9c4f7c587c64c85473586e7b8b0a6c2a40523d45ef3728aa12ab45ac6af

  • C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\ioSpecial.ini

    Filesize

    628B

    MD5

    6f63f5e1a1e02cc323b13cc799264fa2

    SHA1

    16e4f87f9f3b19f590b36869df566af1648ce295

    SHA256

    72a634c2db63507d110e1c6f2c7af7b395b6ce81a6e873d56a3e241cb7ba759b

    SHA512

    35580ed54a0e54c63c17efab834b76ae4e276d8989b34209bc6deebcbf7728edc424a1c69844e508e24303d3dd80413c874ccafd5371fb0506c94c2818767088

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    78KB

    MD5

    490071c63a8583c44546421214809399

    SHA1

    f2268f3629b25b73b7f3ad984d867be01c19a670

    SHA256

    8f75ba9703c28b460025e05615222ed2b31e5eed829bfbab30bb029e873c0c24

    SHA512

    00301e21a10071a875b41ab8dbb715fad81af1c28f2badc8d2580b7b40ef52315fbd4af5e1e9a33c2070c3dc5c818632f0bed98f6e46d0869a3859997e12425b