Analysis
-
max time kernel
151s -
max time network
70s -
platform
windows7_x64 -
resource
win7 -
submitted
06/10/2020, 06:15
Static task
static1
Behavioral task
behavioral1
Sample
Nibiru.bin.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Nibiru.bin.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Nibiru.bin.exe
-
Size
121KB
-
MD5
49d9d587a88074016a2042bdb42b9441
-
SHA1
5659837b54f1c48318025051c8541aa915b80aac
-
SHA256
e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f
-
SHA512
ad8a1f71eeea4dea8073886563191bce9aff27a5c0f28e1f23362787f8a759635996a0434d73792351f30bcbfbe17c455aa4774ff366cc6a79e18c7fc7e3c65d
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SwitchOptimize.raw.Nibiru Nibiru.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 80 IoCs
pid Process 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe 1496 Nibiru.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1496 Nibiru.bin.exe