Resubmissions
08-08-2023 17:21
230808-vw7g5aed44 10Analysis
-
max time kernel
334s -
max time network
1600s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
08-08-2023 17:21
Behavioral task
behavioral1
Sample
Hazard-Nuker.exe
Resource
win10-20230703-en
8 signatures
1800 seconds
General
-
Target
Hazard-Nuker.exe
-
Size
261KB
-
MD5
d147a446f8b11e2e6242b42176f75bed
-
SHA1
aa1c8c74f5df35ff527afb7587a5191a6ead004c
-
SHA256
3d30fea6773ea15b649ae9fbe466828e92c803c1ed8355014f86807dfc410349
-
SHA512
9120206ce7a2f92e919de2b516377c5a36b1d5e3cbd468394864846c0d1faf014ca469624d02fbbf6e4d21f05d0e88fc5373a7b16921c7553485731e46b20e37
-
SSDEEP
3072:TiO7Hla/fpgue2f9bLXhHkOeDVjkaL6r:TdHla/fSuek9H0ki6
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1012-117-0x0000000000D80000-0x0000000000DC6000-memory.dmp disable_win_def -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/1012-117-0x0000000000D80000-0x0000000000DC6000-memory.dmp family_stormkitty -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe" Hazard-Nuker.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.dyndns.org -
Program crash 1 IoCs
pid pid_target Process procid_target 2268 1012 WerFault.exe 69 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1012 Hazard-Nuker.exe 1012 Hazard-Nuker.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1012 Hazard-Nuker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hazard-Nuker.exe"C:\Users\Admin\AppData\Local\Temp\Hazard-Nuker.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1012 -s 13962⤵
- Program crash
PID:2268
-