Overview
overview
7Static
static
3fa3bce9eda...a0.rar
windows7-x64
3fa3bce9eda...a0.rar
windows10-2004-x64
7TNod.1.5.0...te.bat
windows7-x64
6TNod.1.5.0...te.bat
windows10-2004-x64
6TNod.1.5.0...er.bat
windows7-x64
6TNod.1.5.0...er.bat
windows10-2004-x64
6TNod.1.5.0...se.bat
windows7-x64
6TNod.1.5.0...se.bat
windows10-2004-x64
6TNod.1.5.0...UP.exe
windows7-x64
6TNod.1.5.0...UP.exe
windows10-2004-x64
6TNod.1.5.0...ig.bat
windows7-x64
6TNod.1.5.0...ig.bat
windows10-2004-x64
6TNod.1.5.0...up.exe
windows7-x64
7TNod.1.5.0...up.exe
windows10-2004-x64
7TNod.1.5.0...me.url
windows7-x64
6TNod.1.5.0...me.url
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
fa3bce9edaa881657ab820aff942e6a0.rar
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
fa3bce9edaa881657ab820aff942e6a0.rar
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/Insert License with the maximum expiration date.bat
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/Insert License with the maximum expiration date.bat
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/Licenses Downloader.bat
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/Licenses Downloader.bat
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/Recover data of current License.bat
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/Recover data of current License.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/TNODUP.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/TNODUP.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/config.bat
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/config.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
TNod.1.5.0vFinal/TNod-1.4.0-Final.Setup/TNod-1.4.0.15-setup.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
TNod.1.5.0vFinal/TNod-1.4.0-Final.Setup/TNod-1.4.0.15-setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
TNod.1.5.0vFinal/leeme.url
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
TNod.1.5.0vFinal/leeme.url
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
TNod.1.5.0vFinal/TNOD-1.5.0-Final..Portable/config.bat
-
Size
15B
-
MD5
4c396f70f16724f145ab1140efa83cf0
-
SHA1
e4afacc00be2c6abff17c0a72175383a2b9efaa8
-
SHA256
998f65dd33ec6f81079ea24da77f73ddbb117f7cbdc4e6498f9712675c00f585
-
SHA512
c1f9d3cd7a7f1853fea14237d8e8f5d87a698595b1590af22012083494f9681f6a8d03d2082937bd92157323b8ff586ec93dbe628860d9182554b4f4471d2597
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD\CurrentVersion\Info TNODUP.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2288 TNODUP.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe 2288 TNODUP.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2288 TNODUP.exe 2288 TNODUP.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2288 2788 cmd.exe 29 PID 2788 wrote to memory of 2288 2788 cmd.exe 29 PID 2788 wrote to memory of 2288 2788 cmd.exe 29 PID 2788 wrote to memory of 2288 2788 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\TNod.1.5.0vFinal\TNOD-1.5.0-Final..Portable\config.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\TNod.1.5.0vFinal\TNOD-1.5.0-Final..Portable\TNODUP.exeTNODUP /s2⤵
- Checks for any installed AV software in registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2288
-