Overview
overview
10Static
static
3YouTube-Mu...12.exe
windows11-21h2-x64
10$PLUGINSDIR/INetC.dll
windows11-21h2-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
1$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...ic.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
01-07-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
YouTube-Music-Web-Setup-3.3.12.exe
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/INetC.dll
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
$R0/Uninstall YouTube Music.exe
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240611-en
General
-
Target
$R0/Uninstall YouTube Music.exe
-
Size
474KB
-
MD5
bb3f3b6f4ab4b72f1412e05c3fdaec9a
-
SHA1
8a3dc1faf8f67f34346c519945687711e2ae86be
-
SHA256
e953bcdf7dae8da8a13b306d3cf3e42a87e88496a349b7374493b6e4a3c76cf7
-
SHA512
b76e18e85394fc4f1e18c6b283470b3fd03b8774ee70b51a83f1abb4c0173fbc185bdf6e053644571dae124c326ece43309d5a5e8a89ad153ed325b736347f52
-
SSDEEP
3072:6n77v00hEoDEtaucyKViE3CICyX7vaH2tvhOEA1RJCir86SrSrv6Ia3A:6740IHKVpXzs2t0EyL+yaQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Un_A.exepid process 3928 Un_A.exe -
Loads dropped DLL 6 IoCs
Processes:
Un_A.exepid process 3928 Un_A.exe 3928 Un_A.exe 3928 Un_A.exe 3928 Un_A.exe 3928 Un_A.exe 3928 Un_A.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Un_A.exepid process 3928 Un_A.exe 3928 Un_A.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Uninstall YouTube Music.exedescription pid process target process PID 4936 wrote to memory of 3928 4936 Uninstall YouTube Music.exe Un_A.exe PID 4936 wrote to memory of 3928 4936 Uninstall YouTube Music.exe Un_A.exe PID 4936 wrote to memory of 3928 4936 Uninstall YouTube Music.exe Un_A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall YouTube Music.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall YouTube Music.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\StdUtils.dllFilesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\WinShell.dllFilesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\nsExec.dllFilesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exeFilesize
474KB
MD5bb3f3b6f4ab4b72f1412e05c3fdaec9a
SHA18a3dc1faf8f67f34346c519945687711e2ae86be
SHA256e953bcdf7dae8da8a13b306d3cf3e42a87e88496a349b7374493b6e4a3c76cf7
SHA512b76e18e85394fc4f1e18c6b283470b3fd03b8774ee70b51a83f1abb4c0173fbc185bdf6e053644571dae124c326ece43309d5a5e8a89ad153ed325b736347f52