Analysis
-
max time kernel
437s -
max time network
489s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
30-10-2024 19:45
General
-
Target
$PLUGINSDIR/uninstall.exe
-
Size
8.2MB
-
MD5
dc81c01374e9543469920d763402b10a
-
SHA1
535e9355a31bd2a06381e67ff24f52953071478a
-
SHA256
87801f6c52b6660a9f1cb8a832a5bbad75f7d086e3c141f547eafd633bd7cb76
-
SHA512
c37cc90e8b1319b5edb0a55f8462f664fa138d80938053b521d0cd713e04f137244b14d03063a2da9e4e3fdd6c4f8e5a219dc36752eb5caf190b5ef2a6204611
-
SSDEEP
196608:JD18/QDptRqcnqnJ1CcWpxriRRpO/fg/OfPTsxnoygd5:Jh8/EtRqcqnJ8WRRp8g/oTXygX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe" "av:1.0.1" "gv:1.0.1.3" "gs:Official-com" "gi:UA-85655135-28" "an:DroidKit" "c:iMobie"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD53a914fc853188765010b73ff99834383
SHA1374b9c4bcc852e42e85aab7b142ecdd80f0c40a1
SHA2565b8cadf540dd47d19b1020bf5c0aca1b6d14d9d875b0a5794b432401c60ee5c7
SHA5121e1a26dcb480cae7dc0fb89c0e8b560206b23b85a6f56458e2019af9c67ca9f942e2c75e78052e4e0eebcfff5e7a3c5eafb5538ba776c0a40b39cafee0bce0e7
-
Filesize
15KB
MD50325c49a03baf13592272fec2b36968e
SHA1ab10d9f3b420d7192ce6e3ceb953d94b669bdded
SHA25672ddf9ec65f49d38ed181b4e73e095524d9c83118e6d7ae705227c7351300b95
SHA5129009b5ebd7c45ecf9aa967aeddaf6b7695581ee8e212432eeaefd0777df3fbff41842975e0d09774f01b3b994500299042a004efc030162576cca925bdc0f43c
-
Filesize
22KB
MD586a488bf743dfab80ff142713adb5d48
SHA102e4b39f2fa40cd4edcc42cb524dc3ce911bfdac
SHA2563924b57f8993a880d53e1e4e18eb6ba9b5dc610cbb00345c954c7e8a9078c309
SHA5120ed09bcddd5bd13a91e7b99b78e37a01a36d62a29ad74acaacbe0da6446c8523e83ed2c089d2847e4d1ba467da93e2fd2de104feb51bcda445511b334bf932c8
-
Filesize
15KB
MD58205bee74d498724aa5508e93c6d21f8
SHA12564cc3032e59d538826596a88d80c3d022ef595
SHA256382aad28fa439b18d3d41a4652201c1d1542d73ff756a738c4cee6b75ebeca8f
SHA51267c1e7fcfbc03565ddcd0cde4a91104231b30e0e3edbfe338ba5da76085fe849ea2dea199554dd3b25b90ab9722c30fd22399932463ef4a95e6000fcb5ef3ca1
-
Filesize
7.4MB
MD5be3bb1b8ec4f4dff02c1e7af5410ea2d
SHA15bc2a48ed40407018139e897a47df1d65ffe37e8
SHA256d7d45e9e1db7e196bdfa365e6a17c6cf5ad356207e140e63358cd8272981336c
SHA5120bffaa33eba62af045b2fc788fb2268eea2805dc86c68c4f4d2dd62589fe74140d56f7497f083332e4c67086f3e6fc835dc3848696472e307ea7b4a534a61859
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
360KB
-
Filesize
128KB
-
Filesize
7.5MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
4KB
-
Filesize
7.7MB