529b00b1e0dcc8745191cf47fab610ba7c71a725d10c27c16912e4b060956a79

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25ff603d2bb8fa0aabba84e06a0102aa.exe
Size

144KB
MD5

25ff603d2bb8fa0aabba84e06a0102aa
SHA1

0b2ab834280e3484c48d1b4bf16eb6dad2d6c8fd
SHA256

529b00b1e0dcc8745191cf47fab610ba7c71a725d10c27c16912e4b060956a79
SHA512

7d9287cf4094d24dc410662e85e78d01aabcc8228b35996c52225d9bb0e612be3cdd8fbd08234f293906ddc364dcaf9d42a749279acd612cc31342a7891f165d
SSDEEP

3072:NwBElMHV8XpJ5CpUEc+o/szPKRwlMIK/N5CGajrEa:NmJHqIpS/sjKrIi/krEa

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4872	north.exe

Loads dropped DLL 1 IoCs

pid	Process
976	25ff603d2bb8fa0aabba84e06a0102aa.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	north.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	north.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	north.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	north.exe
File opened for modification	C:\Windows\assembly	north.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4872	north.exe
4872	north.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 4872	976	25ff603d2bb8fa0aabba84e06a0102aa.exe	24
PID 976 wrote to memory of 4872	976	25ff603d2bb8fa0aabba84e06a0102aa.exe	24
PID 976 wrote to memory of 4872	976	25ff603d2bb8fa0aabba84e06a0102aa.exe	24

C:\Users\Admin\AppData\Local\Temp\25ff603d2bb8fa0aabba84e06a0102aa.exe
"C:\Users\Admin\AppData\Local\Temp\25ff603d2bb8fa0aabba84e06a0102aa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\nsk4652.tmp\north.exe
  C:\Users\Admin\AppData\Local\Temp\nsk4652.tmp\north.exe /dT201303252014 /u50d1d9d5-cf90-407c-820a-35e05bc06f2f /e5363584
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk4652.tmp\VPatch.dll

Filesize
10KB

MD5
20ee82203544c4f831a7dc1650e7ec51

SHA1
671affb8e32f06777483782197173af254e02548

SHA256
69a00c14562ea5a71f6196b307292fa6d8b1a2fc02368020f40c84b3b0a1a83a

SHA512
4dabcc0cfebb36cfe57fa05777224f45c04c84031cfecf4184bd95d2b148ce18a6c91655320e69c1709e740a261e1e25effc8395fed91d0fc61b18f9a9f7685f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk4652.tmp\north.exe

Filesize
92KB

MD5
d6b8803b65c7f683d3a4fb84ef392dc1

SHA1
94dbc4550b2a416385a16968f975866044818335

SHA256
8721761e0b976635e1465868562b97ffc87c174b4e707522aaea3a3a6ee773ef

SHA512
d23f37ab73f9d3f1f12ed87934cf5f977622aea827a5e7c6296185d7a99765e476f7b0d4bdd88777d210ab29eae02cf9d6785357c5965f07d367d4030073a074

Download Submit
memory/4872-15-0x00000000743A0000-0x0000000074951000-memory.dmp

Filesize
5.7MB

Download
memory/4872-14-0x00000000018F0000-0x0000000001900000-memory.dmp

Filesize
64KB

Download
memory/4872-13-0x00000000743A0000-0x0000000074951000-memory.dmp

Filesize
5.7MB

Download
memory/4872-19-0x00000000018F0000-0x0000000001900000-memory.dmp

Filesize
64KB

Download
memory/4872-18-0x00000000018F0000-0x0000000001900000-memory.dmp

Filesize
64KB

Download
memory/4872-21-0x00000000743A0000-0x0000000074951000-memory.dmp

Filesize
5.7MB

Download