Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2023 23:48
Behavioral task
behavioral1
Sample
38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe
Resource
win7-20230712-en
General
-
Target
38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe
-
Size
293KB
-
MD5
0834595393a68716e6af02c86fed22c0
-
SHA1
a1226559a99cec3fb44ca57f7b5afd063d64f46f
-
SHA256
38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846
-
SHA512
8f4bf0615725b59b51b6d462f48aad96a3fb57d72747c587251396ddef0370e5f3615459e4884083f60c88bc12fd7a91d3fbbafced05f8194227bb6ea707acdc
-
SSDEEP
6144:pftVa3cs0EUsc+w52S2z10iYAtCxALslEtkGxcmRdgyuK/6l8ID4:RuvFUsn02SS/CKLsStnmmRdg18ID4
Malware Config
Extracted
systembc
spexblog17.xyz:4044
admstat45.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
nsnbil.exepid process 1996 nsnbil.exe -
Processes:
resource yara_rule behavioral2/memory/4680-133-0x0000000000400000-0x0000000000670000-memory.dmp upx behavioral2/memory/4680-134-0x0000000000400000-0x0000000000670000-memory.dmp upx behavioral2/memory/4680-135-0x0000000000400000-0x0000000000670000-memory.dmp upx C:\ProgramData\kutv\nsnbil.exe upx C:\ProgramData\kutv\nsnbil.exe upx behavioral2/memory/1996-146-0x0000000000400000-0x0000000000670000-memory.dmp upx behavioral2/memory/1996-147-0x0000000000400000-0x0000000000670000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
Processes:
38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exedescription ioc process File created C:\Windows\Tasks\nsnbil.job 38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe File opened for modification C:\Windows\Tasks\nsnbil.job 38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exepid process 4680 38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe 4680 38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe"C:\Users\Admin\AppData\Local\Temp\38227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4680
-
C:\ProgramData\kutv\nsnbil.exeC:\ProgramData\kutv\nsnbil.exe start21⤵
- Executes dropped EXE
PID:1996
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\kutv\nsnbil.exeFilesize
293KB
MD50834595393a68716e6af02c86fed22c0
SHA1a1226559a99cec3fb44ca57f7b5afd063d64f46f
SHA25638227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846
SHA5128f4bf0615725b59b51b6d462f48aad96a3fb57d72747c587251396ddef0370e5f3615459e4884083f60c88bc12fd7a91d3fbbafced05f8194227bb6ea707acdc
-
C:\ProgramData\kutv\nsnbil.exeFilesize
293KB
MD50834595393a68716e6af02c86fed22c0
SHA1a1226559a99cec3fb44ca57f7b5afd063d64f46f
SHA25638227cba098cf881b7ccb7cbce2228ac0aa4577894167cc6bbbfb5f3ca4cd846
SHA5128f4bf0615725b59b51b6d462f48aad96a3fb57d72747c587251396ddef0370e5f3615459e4884083f60c88bc12fd7a91d3fbbafced05f8194227bb6ea707acdc
-
memory/1996-152-0x0000000002340000-0x0000000002358000-memory.dmpFilesize
96KB
-
memory/1996-151-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/1996-150-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/1996-148-0x0000000002340000-0x0000000002358000-memory.dmpFilesize
96KB
-
memory/1996-147-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/1996-146-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/4680-136-0x0000000000CC0000-0x0000000000CD8000-memory.dmpFilesize
96KB
-
memory/4680-139-0x0000000000CC0000-0x0000000000CD8000-memory.dmpFilesize
96KB
-
memory/4680-138-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/4680-137-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/4680-133-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/4680-135-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/4680-134-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB