Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 16:21

General

  • Target

    uninst.exe

  • Size

    196KB

  • MD5

    80b05828a4c0d54e3a3ca2a4cd61492a

  • SHA1

    f27df18439239725862d94450d284a4e41e5384b

  • SHA256

    9b381dcb55d28fcb668b6f9e4209a7b67c332c5179517fb6ba78fd3f701b8bdc

  • SHA512

    b64e6dce7732d57c62236412cc0f4d08bccaef472134a4b905a3cbbb0c0a7b8b49a58bc1660df1b329621b653c333003840e30293077002c48f931b0333542c3

  • SSDEEP

    3072:BQIURTXJw9XG7MY4VwfavMfAIKiUzKEMIwIyFU2kaf5OQW70HTGrBMhSYfAalScH:BseWrnf3IteEryTkaf5OFQzGr2h9ScH

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uninst.exe
    "C:\Users\Admin\AppData\Local\Temp\uninst.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Users\Admin\AppData\Local\Temp\dqwhj_errwd.exe
        "C:\Users\Admin\AppData\Local\Temp\dqwhj_errwd.exe" /uninstallsucc
        3⤵
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2784

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\lander.ini

          Filesize

          409B

          MD5

          16cd51deb7d1bd427a510c389e82d087

          SHA1

          18b715836c89f55978ff04128d52de905f4e2f76

          SHA256

          97b69cb6229190e10399521e35e0e8f3579b2906f4f0ffca26bd4f7d791fdc5a

          SHA512

          6b9a2ab32b49d20994d8ed338b0125fbc7f39f8c9737855a1d84993b7a1279a2e18d306abc134068cc888398f0386d8c39b4bbe9e3ebfb165c9488b883298429

        • \Users\Admin\AppData\Local\Temp\nsy43B6.tmp\FindProcDLL.dll

          Filesize

          3KB

          MD5

          8614c450637267afacad1645e23ba24a

          SHA1

          e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

          SHA256

          0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

          SHA512

          af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

        • \Users\Admin\AppData\Local\Temp\nsy43B6.tmp\inetc.dll

          Filesize

          20KB

          MD5

          c498ae64b4971132bba676873978de1e

          SHA1

          92e4009cd776b6c8616d8bffade7668ef3cb3c27

          SHA256

          5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

          SHA512

          8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

        • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          196KB

          MD5

          80b05828a4c0d54e3a3ca2a4cd61492a

          SHA1

          f27df18439239725862d94450d284a4e41e5384b

          SHA256

          9b381dcb55d28fcb668b6f9e4209a7b67c332c5179517fb6ba78fd3f701b8bdc

          SHA512

          b64e6dce7732d57c62236412cc0f4d08bccaef472134a4b905a3cbbb0c0a7b8b49a58bc1660df1b329621b653c333003840e30293077002c48f931b0333542c3

        • memory/2040-13-0x0000000010000000-0x0000000010003000-memory.dmp

          Filesize

          12KB

        • memory/2040-29-0x0000000010000000-0x0000000010003000-memory.dmp

          Filesize

          12KB