Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2023 06:04
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
1.3MB
-
MD5
d39e26d541f4f311d0d0a32c05852443
-
SHA1
304c97424e7bde8c7441fe6d9192ab59b9f5cf68
-
SHA256
8d94bbdf7edaafac141e38144cd359a7079da0222f8d3c3b5de585ce31f3c684
-
SHA512
ff0a2ca723d996b4bba1d3e94612f6fd3406e041192cd7671396b071de1267d5c307327747eb014693561fa0dae125410f6c5bc8d75a9955baad4335dad60b05
-
SSDEEP
24576:g20hhVhqnmDqaUrw0esTKZpLXnnBmcud7VS1zyDtSDYf+kATuCqtn/:g2QV6HLzWZJ3nBek1zyDtOkATuCE/
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
file.tmpNitFiles451.exe4NkUcOGzPM6.exepid process 2024 file.tmp 4244 NitFiles451.exe 540 4NkUcOGzPM6.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NitFiles451.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation NitFiles451.exe -
Loads dropped DLL 1 IoCs
Processes:
file.tmppid process 2024 file.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
Processes:
file.tmpdescription ioc process File created C:\Program Files (x86)\Nit Files\is-DRK7P.tmp file.tmp File created C:\Program Files (x86)\Nit Files\is-TPQD9.tmp file.tmp File opened for modification C:\Program Files (x86)\Nit Files\unins000.dat file.tmp File created C:\Program Files (x86)\Nit Files\is-1IUNR.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-N2K0J.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-DFQ0T.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-GRTKE.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-DK0OP.tmp file.tmp File opened for modification C:\Program Files (x86)\Nit Files\NitFiles451.exe file.tmp File created C:\Program Files (x86)\Nit Files\is-8PI89.tmp file.tmp File created C:\Program Files (x86)\Nit Files\unins000.dat file.tmp File created C:\Program Files (x86)\Nit Files\language\is-4ANFM.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-NEIMB.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-4DJVS.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-8T83J.tmp file.tmp File created C:\Program Files (x86)\Nit Files\language\is-PHTNM.tmp file.tmp File created C:\Program Files (x86)\Nit Files\is-I3AUT.tmp file.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2628 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
NitFiles451.exepid process 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe 4244 NitFiles451.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2628 taskkill.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.exefile.tmpNitFiles451.execmd.exedescription pid process target process PID 4616 wrote to memory of 2024 4616 file.exe file.tmp PID 4616 wrote to memory of 2024 4616 file.exe file.tmp PID 4616 wrote to memory of 2024 4616 file.exe file.tmp PID 2024 wrote to memory of 4244 2024 file.tmp NitFiles451.exe PID 2024 wrote to memory of 4244 2024 file.tmp NitFiles451.exe PID 2024 wrote to memory of 4244 2024 file.tmp NitFiles451.exe PID 4244 wrote to memory of 540 4244 NitFiles451.exe 4NkUcOGzPM6.exe PID 4244 wrote to memory of 540 4244 NitFiles451.exe 4NkUcOGzPM6.exe PID 4244 wrote to memory of 540 4244 NitFiles451.exe 4NkUcOGzPM6.exe PID 4244 wrote to memory of 2568 4244 NitFiles451.exe cmd.exe PID 4244 wrote to memory of 2568 4244 NitFiles451.exe cmd.exe PID 4244 wrote to memory of 2568 4244 NitFiles451.exe cmd.exe PID 2568 wrote to memory of 2628 2568 cmd.exe taskkill.exe PID 2568 wrote to memory of 2628 2568 cmd.exe taskkill.exe PID 2568 wrote to memory of 2628 2568 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-81HDD.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-81HDD.tmp\file.tmp" /SL5="$701F8,1133963,233984,C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Nit Files\NitFiles451.exe"C:\Program Files (x86)\Nit Files\NitFiles451.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{cd0d74c0-1ab4-11ed-b686-806e6f6e6963}\4NkUcOGzPM6.exe
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "NitFiles451.exe" /f & erase "C:\Program Files (x86)\Nit Files\NitFiles451.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "NitFiles451.exe" /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Nit Files\NitFiles451.exeFilesize
1.9MB
MD507c8ececbdfb07577afe112d8b60e064
SHA17c3832bc1b43441b91bed89b3c5f5e76bb22f5fc
SHA256ea1bc5d8598482fb383bfedaae1f96ba09f619c6a2ac64146d87163c2f0db302
SHA512235a6cd23283bfe67d96475a672f263966eac81058784528e02406b44b3e294edea302141a324526a49965ab06a86613c90f71f2e1d640b3e1789fa420a20d85
-
C:\Program Files (x86)\Nit Files\NitFiles451.exeFilesize
1.9MB
MD507c8ececbdfb07577afe112d8b60e064
SHA17c3832bc1b43441b91bed89b3c5f5e76bb22f5fc
SHA256ea1bc5d8598482fb383bfedaae1f96ba09f619c6a2ac64146d87163c2f0db302
SHA512235a6cd23283bfe67d96475a672f263966eac81058784528e02406b44b3e294edea302141a324526a49965ab06a86613c90f71f2e1d640b3e1789fa420a20d85
-
C:\Users\Admin\AppData\Local\Temp\is-81HDD.tmp\file.tmpFilesize
849KB
MD556c525b0e7751035562a3bd35096b17d
SHA1befb8a8e73e296e95412b319bc20f76fb382d525
SHA2566fbb6401d3de1f971f182f9292e817fbeee537725cd5a5974b2bd7bd90a26559
SHA51275e793a12229ac68cc5ed92d97c1db55dbeb1712cb5377fc2323363e4ffd026f2e68c7852fa0eb6837c8ba7f5449a70160c3cadb49c062c4dc53cdbccdf6d354
-
C:\Users\Admin\AppData\Local\Temp\is-81HDD.tmp\file.tmpFilesize
849KB
MD556c525b0e7751035562a3bd35096b17d
SHA1befb8a8e73e296e95412b319bc20f76fb382d525
SHA2566fbb6401d3de1f971f182f9292e817fbeee537725cd5a5974b2bd7bd90a26559
SHA51275e793a12229ac68cc5ed92d97c1db55dbeb1712cb5377fc2323363e4ffd026f2e68c7852fa0eb6837c8ba7f5449a70160c3cadb49c062c4dc53cdbccdf6d354
-
C:\Users\Admin\AppData\Local\Temp\is-GLI7K.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Roaming\{cd0d74c0-1ab4-11ed-b686-806e6f6e6963}\4NkUcOGzPM6.exeFilesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
C:\Users\Admin\AppData\Roaming\{cd0d74c0-1ab4-11ed-b686-806e6f6e6963}\4NkUcOGzPM6.exeFilesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
memory/540-144-0x0000000000000000-mapping.dmp
-
memory/2024-134-0x0000000000000000-mapping.dmp
-
memory/2568-152-0x0000000000000000-mapping.dmp
-
memory/2628-153-0x0000000000000000-mapping.dmp
-
memory/4244-151-0x0000000000400000-0x00000000013E9000-memory.dmpFilesize
15.9MB
-
memory/4244-143-0x0000000000400000-0x00000000013E9000-memory.dmpFilesize
15.9MB
-
memory/4244-142-0x0000000000400000-0x00000000013E9000-memory.dmpFilesize
15.9MB
-
memory/4244-147-0x0000000010000000-0x000000001001B000-memory.dmpFilesize
108KB
-
memory/4244-139-0x0000000000000000-mapping.dmp
-
memory/4244-154-0x0000000000400000-0x00000000013E9000-memory.dmpFilesize
15.9MB
-
memory/4616-132-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4616-138-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4616-155-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB