Analysis
-
max time kernel
151s -
max time network
70s -
platform
windows7_x64 -
resource
win7 -
submitted
06-10-2020 06:15
General
-
Target
Nibiru.bin.exe
-
Size
121KB
-
MD5
49d9d587a88074016a2042bdb42b9441
-
SHA1
5659837b54f1c48318025051c8541aa915b80aac
-
SHA256
e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f
-
SHA512
ad8a1f71eeea4dea8073886563191bce9aff27a5c0f28e1f23362787f8a759635996a0434d73792351f30bcbfbe17c455aa4774ff366cc6a79e18c7fc7e3c65d
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 80 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nibiru.bin.exe"C:\Users\Admin\AppData\Local\Temp\Nibiru.bin.exe"1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1496-0-0x0000000073B80000-0x000000007426E000-memory.dmpFilesize
6.9MB
-
memory/1496-1-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB