878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninst.exe
Size 138KB
Sample250122-e5tdvsykgx
SHA256 6f0baf53513b09eee91da1e92a4ac6637e606a645b52adee5fd0402de9232548
MD5 69f11311116dea38b390d99ccc295b24
SHA1 eceb02f012a978f518f0928a00017fe263aeec8a
SHA512 73fe603810ccfe1ad2d43ab9917d6adbe8c189d558ed709c7f703c7400848a18b0a989d0a5b18e6b5208ab3d7d5880dd686dea38fc32b8bee0a207436b20ba2e
SSDEEP 3072:dnPdzuK8Jdw4TMJw3uXceAuH7v6OjxaJE1WQav1vb2MyE:dnPdudwDzmuT6OjxaBQav1TsE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2036	Un.exe

Executes dropped EXE 1 IoCs

pid	Process
2036	Un.exe

Loads dropped DLL 6 IoCs

pid	Process
2036	Un.exe
2036	Un.exe
2036	Un.exe
2036	Un.exe
2036	Un.exe
2036	Un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	Un.exe
2036	Un.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2036	3216	uninst.exe	81
PID 3216 wrote to memory of 2036	3216	uninst.exe	81
PID 3216 wrote to memory of 2036	3216	uninst.exe	81

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr97CD.tmp\FindProcDLL.dll
Size 3KB
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
MD5 SHA1 SHA512

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr97CD.tmp\LangDLL.dll
Size 5KB
SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
MD5 50016010fb0d8db2bc4cd258ceb43be5
SHA1 44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA512 ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP 48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr97CD.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr97CD.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsisFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr97CD.tmp\nsisFirewallW.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Un.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
Size 138KB
SHA256 6f0baf53513b09eee91da1e92a4ac6637e606a645b52adee5fd0402de9232548
MD5 69f11311116dea38b390d99ccc295b24
SHA1 eceb02f012a978f518f0928a00017fe263aeec8a
SHA512 73fe603810ccfe1ad2d43ab9917d6adbe8c189d558ed709c7f703c7400848a18b0a989d0a5b18e6b5208ab3d7d5880dd686dea38fc32b8bee0a207436b20ba2e
SSDEEP 3072:dnPdzuK8Jdw4TMJw3uXceAuH7v6OjxaJE1WQav1vb2MyE:dnPdudwDzmuT6OjxaBQav1TsE
MD5 SHA1 SHA512 SSDEEP

Submit Download