Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2023 06:04
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
1.3MB
-
MD5
d39e26d541f4f311d0d0a32c05852443
-
SHA1
304c97424e7bde8c7441fe6d9192ab59b9f5cf68
-
SHA256
8d94bbdf7edaafac141e38144cd359a7079da0222f8d3c3b5de585ce31f3c684
-
SHA512
ff0a2ca723d996b4bba1d3e94612f6fd3406e041192cd7671396b071de1267d5c307327747eb014693561fa0dae125410f6c5bc8d75a9955baad4335dad60b05
-
SSDEEP
24576:g20hhVhqnmDqaUrw0esTKZpLXnnBmcud7VS1zyDtSDYf+kATuCqtn/:g2QV6HLzWZJ3nBek1zyDtOkATuCE/
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2024 file.tmp 4244 NitFiles451.exe 540 4NkUcOGzPM6.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation NitFiles451.exe -
Loads dropped DLL 1 IoCs
pid Process 2024 file.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Nit Files\is-DRK7P.tmp file.tmp File created C:\Program Files (x86)\Nit Files\is-TPQD9.tmp file.tmp File opened for modification C:\Program Files (x86)\Nit Files\unins000.dat file.tmp File created C:\Program Files (x86)\Nit Files\is-1IUNR.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-N2K0J.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-DFQ0T.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-GRTKE.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-DK0OP.tmp file.tmp File opened for modification C:\Program Files (x86)\Nit Files\NitFiles451.exe file.tmp File created C:\Program Files (x86)\Nit Files\is-8PI89.tmp file.tmp File created C:\Program Files (x86)\Nit Files\unins000.dat file.tmp File created C:\Program Files (x86)\Nit Files\language\is-4ANFM.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-NEIMB.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-4DJVS.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-8T83J.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-PHTNM.tmp file.tmp File created C:\Program Files (x86)\Nit Files\is-I3AUT.tmp file.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 2628 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2628 taskkill.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2024 4616 file.exe 81 PID 4616 wrote to memory of 2024 4616 file.exe 81 PID 4616 wrote to memory of 2024 4616 file.exe 81 PID 2024 wrote to memory of 4244 2024 file.tmp 82 PID 2024 wrote to memory of 4244 2024 file.tmp 82 PID 2024 wrote to memory of 4244 2024 file.tmp 82 PID 4244 wrote to memory of 540 4244 NitFiles451.exe 83 PID 4244 wrote to memory of 540 4244 NitFiles451.exe 83 PID 4244 wrote to memory of 540 4244 NitFiles451.exe 83 PID 4244 wrote to memory of 2568 4244 NitFiles451.exe 85 PID 4244 wrote to memory of 2568 4244 NitFiles451.exe 85 PID 4244 wrote to memory of 2568 4244 NitFiles451.exe 85 PID 2568 wrote to memory of 2628 2568 cmd.exe 87 PID 2568 wrote to memory of 2628 2568 cmd.exe 87 PID 2568 wrote to memory of 2628 2568 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\is-81HDD.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-81HDD.tmp\file.tmp" /SL5="$701F8,1133963,233984,C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Nit Files\NitFiles451.exe"C:\Program Files (x86)\Nit Files\NitFiles451.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Roaming\{cd0d74c0-1ab4-11ed-b686-806e6f6e6963}\4NkUcOGzPM6.exe
- Executes dropped EXE
PID:540
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "NitFiles451.exe" /f & erase "C:\Program Files (x86)\Nit Files\NitFiles451.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "NitFiles451.exe" /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD507c8ececbdfb07577afe112d8b60e064
SHA17c3832bc1b43441b91bed89b3c5f5e76bb22f5fc
SHA256ea1bc5d8598482fb383bfedaae1f96ba09f619c6a2ac64146d87163c2f0db302
SHA512235a6cd23283bfe67d96475a672f263966eac81058784528e02406b44b3e294edea302141a324526a49965ab06a86613c90f71f2e1d640b3e1789fa420a20d85
-
Filesize
1.9MB
MD507c8ececbdfb07577afe112d8b60e064
SHA17c3832bc1b43441b91bed89b3c5f5e76bb22f5fc
SHA256ea1bc5d8598482fb383bfedaae1f96ba09f619c6a2ac64146d87163c2f0db302
SHA512235a6cd23283bfe67d96475a672f263966eac81058784528e02406b44b3e294edea302141a324526a49965ab06a86613c90f71f2e1d640b3e1789fa420a20d85
-
Filesize
849KB
MD556c525b0e7751035562a3bd35096b17d
SHA1befb8a8e73e296e95412b319bc20f76fb382d525
SHA2566fbb6401d3de1f971f182f9292e817fbeee537725cd5a5974b2bd7bd90a26559
SHA51275e793a12229ac68cc5ed92d97c1db55dbeb1712cb5377fc2323363e4ffd026f2e68c7852fa0eb6837c8ba7f5449a70160c3cadb49c062c4dc53cdbccdf6d354
-
Filesize
849KB
MD556c525b0e7751035562a3bd35096b17d
SHA1befb8a8e73e296e95412b319bc20f76fb382d525
SHA2566fbb6401d3de1f971f182f9292e817fbeee537725cd5a5974b2bd7bd90a26559
SHA51275e793a12229ac68cc5ed92d97c1db55dbeb1712cb5377fc2323363e4ffd026f2e68c7852fa0eb6837c8ba7f5449a70160c3cadb49c062c4dc53cdbccdf6d354
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c