4c8ee30b6515c2de643d67c4af908067c40e6810daa5c8585938208101dcfbf1

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12924c1485ff271c0ab55788b6b6666f.exe
Size

392KB
MD5

12924c1485ff271c0ab55788b6b6666f
SHA1

90ca51af2a02b359fb5869057a5dab34645a4691
SHA256

4c8ee30b6515c2de643d67c4af908067c40e6810daa5c8585938208101dcfbf1
SHA512

5887632ca8440bf19a9c01e42512b0fb47870c226fe3edf81475e4d39cd09fc46ba0c53465610d5d069a671e5d56364d011d9780900ef41ffde0f261f2f61913
SSDEEP

6144:e3Bn84cWxCfsbMam4XspTJ755+SQ0FdiXzen/Q/uib0lkb9fcI+dtJ:elaEgnRJDe0+XzmpU0s9fcIc

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2956	nkrmg.exe

Loads dropped DLL 2 IoCs

pid	Process
3068	12924c1485ff271c0ab55788b6b6666f.exe
3068	12924c1485ff271c0ab55788b6b6666f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tkq = "\"c:\\windows\\system32\\0407\\nkrmg.exe\""	12924c1485ff271c0ab55788b6b6666f.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\0407\nkrmg.exe	12924c1485ff271c0ab55788b6b6666f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\90b10d22.log	12924c1485ff271c0ab55788b6b6666f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3068	12924c1485ff271c0ab55788b6b6666f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3068	12924c1485ff271c0ab55788b6b6666f.exe
2956	nkrmg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2956	3068	12924c1485ff271c0ab55788b6b6666f.exe	29
PID 3068 wrote to memory of 2956	3068	12924c1485ff271c0ab55788b6b6666f.exe	29
PID 3068 wrote to memory of 2956	3068	12924c1485ff271c0ab55788b6b6666f.exe	29
PID 3068 wrote to memory of 2956	3068	12924c1485ff271c0ab55788b6b6666f.exe	29

C:\Users\Admin\AppData\Local\Temp\12924c1485ff271c0ab55788b6b6666f.exe
"C:\Users\Admin\AppData\Local\Temp\12924c1485ff271c0ab55788b6b6666f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\windows\SysWOW64\0407\nkrmg.exe
  "C:\windows\system32\0407\nkrmg.exe" /i
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\90b10d22.log

Filesize
96B

MD5
5e5715835dc0a5ff3d1333e2e9c23672

SHA1
0b12eded13256aef9324ea95f140e19450019f78

SHA256
aa8e55d418f443985ee2cfb5ede18501b4a4ff3ec14f2ad43523745419f39ce7

SHA512
3dbaf2fa5f5bdec47b9141705528c085d5b7b1a3e8b5fd03c68e82bfa3900f07aaf379b3387e6885ad13ce4e0ed8e21f5910a05be8e14b79292119cc24869bfd

Download Submit
C:\Windows\SysWOW64\0407\nkrmg.exe

Filesize
370KB

MD5
174f82238e25872ac292ce29c0ee7f05

SHA1
abe93af52b623d9a0829ee989aa4521ad5ac9a57

SHA256
82a53a03ce8d7bfdf57429824efec6cd1d6024d93bc7280140882df9f69f3421

SHA512
7af396319d18692829d45bde72a3e16557fedf35dc571744ede78ef29a54228a44d7c6c9c68b5143517d13f152202a9d3ff2c1d2e2d0cddbea996a54b8b750de

Download Submit
\Windows\SysWOW64\0407\nkrmg.exe

Filesize
392KB

MD5
12924c1485ff271c0ab55788b6b6666f

SHA1
90ca51af2a02b359fb5869057a5dab34645a4691

SHA256
4c8ee30b6515c2de643d67c4af908067c40e6810daa5c8585938208101dcfbf1

SHA512
5887632ca8440bf19a9c01e42512b0fb47870c226fe3edf81475e4d39cd09fc46ba0c53465610d5d069a671e5d56364d011d9780900ef41ffde0f261f2f61913

Download Submit
memory/2956-17-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3068-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3068-1-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3068-4-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3068-13-0x00000000030A0000-0x0000000003103000-memory.dmp

Filesize
396KB

Download
memory/3068-24-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download