0137f1a746d2a74f35d557bafb233dc8cdcb602731d4de0f7e083fb12e0d80d5

Analysis

Target

forcenitro2.7.exe
Size

123.3MB
MD5

3fc886fc28c6d6973ed8a54da490153e
SHA1

89173cdbbc18d8af60f0c35b471c7fb850e81420
SHA256

0137f1a746d2a74f35d557bafb233dc8cdcb602731d4de0f7e083fb12e0d80d5
SHA512

d939a5075dfce9f7e229f2377236e49b94fad584b7979cdc6799ad200a78f9ff971556ac6f873aacedf95ea2337a6ca4216222c34f9c30f575be5892c43110d2

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

forcenitro2.7.exe

pid process

964 forcenitro2.7.exe

pid	process
964	forcenitro2.7.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

forcenitro2.7.exetaskeng.exe

description	pid	process	target process
PID 1596 wrote to memory of 964	1596	forcenitro2.7.exe	forcenitro2.7.exe
PID 1596 wrote to memory of 964	1596	forcenitro2.7.exe	forcenitro2.7.exe
PID 1596 wrote to memory of 964	1596	forcenitro2.7.exe	forcenitro2.7.exe
PID 1164 wrote to memory of 748	1164	taskeng.exe	default-browser-agent.exe
PID 1164 wrote to memory of 748	1164	taskeng.exe	default-browser-agent.exe
PID 1164 wrote to memory of 748	1164	taskeng.exe	default-browser-agent.exe

C:\Users\Admin\AppData\Local\Temp\forcenitro2.7.exe
"C:\Users\Admin\AppData\Local\Temp\forcenitro2.7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Users\Admin\AppData\Local\Temp\forcenitro2.7.exe
"C:\Users\Admin\AppData\Local\Temp\forcenitro2.7.exe"
2⤵
- Loads dropped DLL
PID:964

C:\Windows\system32\taskeng.exe
taskeng.exe {71D9DA26-4419-4A07-8B76-82ABC92CB3C2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:636

C:\Windows\system32\taskeng.exe
taskeng.exe {B488993D-9B7F-464F-B23B-78348A617861} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:748

C:\Windows\system32\taskeng.exe
taskeng.exe {7018F771-B225-4C4D-95C9-FCA1CA1B100D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:756

C:\Users\Admin\AppData\Local\Temp\_MEI15962\python39.dll
MD5
1d5e4c20a20740f38f061bdf48aaca4f

SHA1
de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

SHA256
f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

SHA512
9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15962\python39.dll
MD5
1d5e4c20a20740f38f061bdf48aaca4f

SHA1
de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

SHA256
f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

SHA512
9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

Download Submit
memory/748-57-0x0000000000000000-mapping.dmp

Download
memory/964-54-0x0000000000000000-mapping.dmp

Download