Analysis
- max time kernel
26s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 17:28
Behavioral task
behavioral1
Sample
Uninstalr_Portable.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target Uninstalr_Portable.exe
- Size 7.5MB
- Sample260712-v2aekset6q
- SHA256 1c98209a99489f4ef564a7bf113aec375e10f61253a97a2997ffa776df5d0345
- MD5 e97ad4e2a983e505eab2b4af8844ab8e
- SHA1 bb5ad919d8132c4cd542837fefa4cf5a0d460b2d
- SHA512 e7dce5c4b4369c4d0a3dad192a139b4fb7a9c2b80e728080cc19e48d1b9a6227c166fc9bc78169357db756b8ee7cae275a3ca4c0edde2f70355b4615ac6175a7
- SSDEEP 196608:zmPSpC2GyXGEy+I7gXaA9/t29yMbA3urrGRFaWbrb5u/llx:zmPaXO+WehEF8+rGRZVellx
- TLSH T1CF763341B70B34A7D43D863C7346ED49D7A13FB982C417A82A4EF9586472B62E8BC11F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Uninstalr_Portable.exe File opened (read-only) \??\H: Uninstalr_Portable.exe File opened (read-only) \??\I: Uninstalr_Portable.exe File opened (read-only) \??\L: Uninstalr_Portable.exe File opened (read-only) \??\O: Uninstalr_Portable.exe File opened (read-only) \??\Q: Uninstalr_Portable.exe File opened (read-only) \??\R: Uninstalr_Portable.exe File opened (read-only) \??\Y: Uninstalr_Portable.exe File opened (read-only) \??\Z: Uninstalr_Portable.exe File opened (read-only) \??\G: Uninstalr_Portable.exe File opened (read-only) \??\P: Uninstalr_Portable.exe File opened (read-only) \??\U: Uninstalr_Portable.exe File opened (read-only) \??\g: Uninstalr_Portable.exe File opened (read-only) \??\a: Uninstalr_Portable.exe File opened (read-only) \??\h: Uninstalr_Portable.exe File opened (read-only) \??\i: Uninstalr_Portable.exe File opened (read-only) \??\o: Uninstalr_Portable.exe File opened (read-only) \??\J: Uninstalr_Portable.exe File opened (read-only) \??\W: Uninstalr_Portable.exe File opened (read-only) \??\d: Uninstalr_Portable.exe File opened (read-only) \??\l: Uninstalr_Portable.exe File opened (read-only) \??\q: Uninstalr_Portable.exe File opened (read-only) \??\s: Uninstalr_Portable.exe File opened (read-only) \??\w: Uninstalr_Portable.exe File opened (read-only) \??\y: Uninstalr_Portable.exe File opened (read-only) \??\D: Uninstalr_Portable.exe File opened (read-only) \??\M: Uninstalr_Portable.exe File opened (read-only) \??\N: Uninstalr_Portable.exe File opened (read-only) \??\r: Uninstalr_Portable.exe File opened (read-only) \??\t: Uninstalr_Portable.exe File opened (read-only) \??\u: Uninstalr_Portable.exe File opened (read-only) \??\v: Uninstalr_Portable.exe File opened (read-only) \??\x: Uninstalr_Portable.exe File opened (read-only) \??\A: Uninstalr_Portable.exe File opened (read-only) \??\B: Uninstalr_Portable.exe File opened (read-only) \??\T: Uninstalr_Portable.exe File opened (read-only) \??\V: Uninstalr_Portable.exe File opened (read-only) \??\X: Uninstalr_Portable.exe File opened (read-only) \??\b: Uninstalr_Portable.exe File opened (read-only) \??\m: Uninstalr_Portable.exe File opened (read-only) \??\n: Uninstalr_Portable.exe File opened (read-only) \??\K: Uninstalr_Portable.exe File opened (read-only) \??\z: Uninstalr_Portable.exe File opened (read-only) \??\j: Uninstalr_Portable.exe File opened (read-only) \??\k: Uninstalr_Portable.exe File opened (read-only) \??\p: Uninstalr_Portable.exe -
resource yara_rule behavioral2/memory/3788-0-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-13-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-14-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-17-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-26-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-28-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-29-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-30-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-31-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-32-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-33-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-34-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-35-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-36-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-37-0x0000000000A90000-0x000000000336B000-memory.dmp upx behavioral2/memory/3788-38-0x0000000000A90000-0x000000000336B000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstalr_Portable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 4364 WMIC.exe 4364 WMIC.exe 4364 WMIC.exe 4364 WMIC.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe 3788 Uninstalr_Portable.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4364 WMIC.exe Token: SeSecurityPrivilege 4364 WMIC.exe Token: SeTakeOwnershipPrivilege 4364 WMIC.exe Token: SeLoadDriverPrivilege 4364 WMIC.exe Token: SeSystemProfilePrivilege 4364 WMIC.exe Token: SeSystemtimePrivilege 4364 WMIC.exe Token: SeProfSingleProcessPrivilege 4364 WMIC.exe Token: SeIncBasePriorityPrivilege 4364 WMIC.exe Token: SeCreatePagefilePrivilege 4364 WMIC.exe Token: SeBackupPrivilege 4364 WMIC.exe Token: SeRestorePrivilege 4364 WMIC.exe Token: SeShutdownPrivilege 4364 WMIC.exe Token: SeDebugPrivilege 4364 WMIC.exe Token: SeSystemEnvironmentPrivilege 4364 WMIC.exe Token: SeRemoteShutdownPrivilege 4364 WMIC.exe Token: SeUndockPrivilege 4364 WMIC.exe Token: SeManageVolumePrivilege 4364 WMIC.exe Token: 33 4364 WMIC.exe Token: 34 4364 WMIC.exe Token: 35 4364 WMIC.exe Token: 36 4364 WMIC.exe Token: SeIncreaseQuotaPrivilege 4364 WMIC.exe Token: SeSecurityPrivilege 4364 WMIC.exe Token: SeTakeOwnershipPrivilege 4364 WMIC.exe Token: SeLoadDriverPrivilege 4364 WMIC.exe Token: SeSystemProfilePrivilege 4364 WMIC.exe Token: SeSystemtimePrivilege 4364 WMIC.exe Token: SeProfSingleProcessPrivilege 4364 WMIC.exe Token: SeIncBasePriorityPrivilege 4364 WMIC.exe Token: SeCreatePagefilePrivilege 4364 WMIC.exe Token: SeBackupPrivilege 4364 WMIC.exe Token: SeRestorePrivilege 4364 WMIC.exe Token: SeShutdownPrivilege 4364 WMIC.exe Token: SeDebugPrivilege 4364 WMIC.exe Token: SeSystemEnvironmentPrivilege 4364 WMIC.exe Token: SeRemoteShutdownPrivilege 4364 WMIC.exe Token: SeUndockPrivilege 4364 WMIC.exe Token: SeManageVolumePrivilege 4364 WMIC.exe Token: 33 4364 WMIC.exe Token: 34 4364 WMIC.exe Token: 35 4364 WMIC.exe Token: 36 4364 WMIC.exe Token: SeSecurityPrivilege 1192 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3788 Uninstalr_Portable.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3788 Uninstalr_Portable.exe 1192 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3436 3788 Uninstalr_Portable.exe 90 PID 3788 wrote to memory of 4716 3788 Uninstalr_Portable.exe 91 PID 3436 wrote to memory of 4788 3436 cmd.exe 94 PID 3436 wrote to memory of 3468 3436 cmd.exe 95 PID 4716 wrote to memory of 4364 4716 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstalr_Portable.exe"C:\Users\Admin\AppData\Local\Temp\Uninstalr_Portable.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "dir C:\*.exe /s /b | findstr /v /i /c:"C:\Windows" > "C:\Users\Admin\AppData\Local\Temp\Uninstalr\Uninstalr_AllExeFiles.tmp""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir C:\*.exe /s /b "3⤵
- System Location Discovery: System Language Discovery
PID:4788
-
-
C:\Windows\SysWOW64\findstr.exefindstr /v /i /c:"C:\Windows"3⤵
- System Location Discovery: System Language Discovery
PID:3468
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic product get InstallDate, InstallLocation, Name, Vendor, Version > "C:\Users\Admin\AppData\Local\Temp\Uninstalr\Uninstalr_can_delete_x2_240743703.tmp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic product get InstallDate, InstallLocation, Name, Vendor, Version3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1192
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Uninstalr\Uninstalr.dat.tmp
- Size 3B
- SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
- MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
- SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
- SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
- MD5 SHA1 SHA512