Nibiru.bin.zip

General
Target

Nibiru.bin.exe

Filesize

121KB

Completed

06-10-2020 06:18

Score
7 /10
MD5

49d9d587a88074016a2042bdb42b9441

SHA1

5659837b54f1c48318025051c8541aa915b80aac

SHA256

e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f

Malware Config
Signatures 3

Filter: none

Collection
Credential Access
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Suspicious behavior: EnumeratesProcesses
    Nibiru.bin.exe

    Reported IOCs

    pidprocess
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
    792Nibiru.bin.exe
  • Suspicious use of AdjustPrivilegeToken
    Nibiru.bin.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege792Nibiru.bin.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\Nibiru.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\Nibiru.bin.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:792
  • C:\Windows\explorer.exe
    explorer.exe
    PID:2568
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/792-0-0x0000000073270000-0x000000007395E000-memory.dmp

                        Download
                      • memory/792-1-0x00000000002D0000-0x00000000002D1000-memory.dmp

                        Download
                      • memory/792-3-0x0000000004B30000-0x0000000004B31000-memory.dmp

                        Download
                      • memory/792-4-0x00000000051A0000-0x00000000051A1000-memory.dmp

                        Download
                      • memory/792-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                        Download
                      • memory/792-6-0x00000000026A0000-0x00000000026A1000-memory.dmp

                        Download
                      • memory/792-7-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                        Download