4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a

General

Target
4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a.exe
Size 161KB
Sample260930-kbqnrsscla
SHA256 4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a
MD5 8b6dd78d8321314e1af84995e831ea4b
SHA1 ad061eca425f4ae5a2e2d99d786b4ae93d64e9c7
SHA512 83d734071ca70db4c0f9d69beaf0c693faa37a88d8eabe60ad54908b1483e0ce4046993696c180fcd90a26a8c62731c2dcaccc0b7b6f239e664d46cf248bc306
SSDEEP 3072:uX47fcIrwR8ksuSKC+daIT7mEnrOzcPgGFsgD6ADL/joJ9MGRs4L+G2:uX45rw6x2aITJrOzcFFrXjooGRs62
TLSH
T1DEF3021557A4C4B7D5F707706C7E8BB37FF6B82202A8C72B5340476EBD21A809A1E352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	Un.exe

Loads dropped DLL 7 IoCs

pid	Process
3036	Un.exe
3036	Un.exe
3036	Un.exe
3036	Un.exe
3036	Un.exe
3036	Un.exe
3036	Un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4904	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	Un.exe
3036	Un.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3036	4116	4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a.exe	89
PID 3036 wrote to memory of 4904	3036	Un.exe	90

C:\Users\Admin\AppData\Local\Temp\4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a.exe
"C:\Users\Admin\AppData\Local\Temp\4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM meetily.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy265C.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy265C.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy265C.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy265C.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
Size 161KB
SHA256 4a47fc55eeb2f813c08fd75ac09ac95fcccca0a4355ff97a2f8d9694bafeaa6a
MD5 8b6dd78d8321314e1af84995e831ea4b
SHA1 ad061eca425f4ae5a2e2d99d786b4ae93d64e9c7
SHA512 83d734071ca70db4c0f9d69beaf0c693faa37a88d8eabe60ad54908b1483e0ce4046993696c180fcd90a26a8c62731c2dcaccc0b7b6f239e664d46cf248bc306
SSDEEP 3072:uX47fcIrwR8ksuSKC+daIT7mEnrOzcPgGFsgD6ADL/joJ9MGRs4L+G2:uX45rw6x2aITJrOzcFFrXjooGRs62
TLSH
T1DEF3021557A4C4B7D5F707706C7E8BB37FF6B82202A8C72B5340476EBD21A809A1E352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads