f16a87e183bfe34afc75098a027d9397bf97a8fd2d289abe723d628072602b3c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19/02/2024, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
Size

10.3MB
MD5

deb8e6b240f3fe4f14717f270bc7d72b
SHA1

454d0cc939a7c45fcd38f2a10a6fe025d8c2a1ba
SHA256

f16a87e183bfe34afc75098a027d9397bf97a8fd2d289abe723d628072602b3c
SHA512

cd3da01d3305e722cec703e4e7a5581ca1e73a6f8a6133ed0fb8e4a2a8c619dd719ce390f8fce142b1a06171f9576d679c80b19b099e306d2ea2a69a9aee6b83
SSDEEP

196608:SDf+GIzme9onJ5hrZERlyiU8AdZYJERS48RmU/3ZlsPvarTsZg8CNhHSzCqblZou:JPzJ9c5hlERJAdZYygtN3ZWarQcHSl6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 18 IoCs

pid	Process
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4872	4932	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	82
PID 4932 wrote to memory of 4872	4932	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	82
PID 4872 wrote to memory of 3188	4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	83
PID 4872 wrote to memory of 3188	4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	83
PID 4872 wrote to memory of 2212	4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	84
PID 4872 wrote to memory of 2212	4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	84
PID 4872 wrote to memory of 4996	4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	86
PID 4872 wrote to memory of 4996	4872	SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe	86

C:\Users\Admin\AppData\Local\Temp\SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
"C:\Users\Admin\AppData\Local\Temp\SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe
  "C:\Users\Admin\AppData\Local\Temp\SPOILER_SPOILER_SPOILER_Discord_Nitro_Generator.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Discord Nitro Generator - made by ytzmo#8888
    3⤵
    PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_asyncio.pyd

Filesize
62KB

MD5
05f37b6be4cd6b5dc8f165128913cf89

SHA1
04aab6f380f40dcae85cbe0c397356187bd7bfeb

SHA256
0ed512e410a8604821f74c84396dd61e71756dbe8e36e8a96261c707b659721a

SHA512
263726f87375a29335b4dcaec38bb79c8f019a7240be9af82d52aacc93611227b77ae61d03dc05f92edf138715e0d262901d824285a7a1caacd30110e093d6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_bz2.pyd

Filesize
83KB

MD5
6c7565c1efffe44cb0616f5b34faa628

SHA1
88dd24807da6b6918945201c74467ca75e155b99

SHA256
fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

SHA512
822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ctypes.pyd

Filesize
122KB

MD5
29da9b022c16da461392795951ce32d9

SHA1
0e514a8f88395b50e797d481cbbed2b4ae490c19

SHA256
3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

SHA512
5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_hashlib.pyd

Filesize
63KB

MD5
f377a418addeeb02f223f45f6f168fe6

SHA1
5d8d42dec5d08111e020614600bbf45091c06c0b

SHA256
9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac

SHA512
6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_lzma.pyd

Filesize
157KB

MD5
b5355dd319fb3c122bb7bf4598ad7570

SHA1
d7688576eceadc584388a179eed3155716c26ef5

SHA256
b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

SHA512
0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_overlapped.pyd

Filesize
44KB

MD5
bf495600c3d758141bed531faabf2a4f

SHA1
5f20ab7e478b30db6d6dee90ab23b26a219d6604

SHA256
af74c3fc4bc87e1ed70e11a700a073df77c4c891b6fad17a9f019df0d32c18fc

SHA512
ed4bcfe35fe6f471cd9ff9220aacfd89c547227a9981d98427a721f39accf7ebd99ba88977ee27cd353570671203d992d6d94b3dcb567e0188602db8ce353117

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_pytransform.dll

Filesize
562KB

MD5
f795a8a7ed4e439dd0dd4f4eb445c653

SHA1
17b2b7aa0f420e2216268ea716143319e321afb5

SHA256
7e637555e58b119c4146a8755f08cde7605fcd297502fdf13af340bcfc151437

SHA512
bc8689ad77518426cdceaa7400efa8e3f276925446bce23ff01d293b9c5b58d0c09c371df1e3b0be989830e164168a456088f383c42e82845fb150bbcb4b8a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_pytransform.dll

Filesize
396KB

MD5
ebf54f3395b0b6c691823e8e8dbd450f

SHA1
d1324790ef312547c85cdf495a180392b53e717d

SHA256
9d033e26193e105473796c7f41da0ce17dc08adf2997ad268c8397bc5e4025c8

SHA512
3b7caaf17c064cafbfde14b63eeef8f2b46250b27e85075efe6bf7ec01429553ffd9a7a6795461205b705aa5cc7f1b8e1547952cd40b62cd1f17bff1e36cda7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_queue.pyd

Filesize
27KB

MD5
4ab2ceb88276eba7e41628387eacb41e

SHA1
58f7963ba11e1d3942414ef6dab3300a33c8a2bd

SHA256
d82ab111224c54bab3eefdcfeb3ba406d74d2884518c5a2e9174e5c6101bd839

SHA512
b0d131e356ce35e603acf0168e540c89f600ba2ab2099ccf212e0b295c609702ac4a7b0a7dbc79f46eda50e7ea2cf09917832345dd8562d916d118aba2fa3888

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_socket.pyd

Filesize
77KB

MD5
f5dd9c5922a362321978c197d3713046

SHA1
4fbc2d3e15f8bb21ecc1bf492f451475204426cd

SHA256
4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

SHA512
ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ssl.pyd

Filesize
149KB

MD5
ef4755195cc9b2ff134ea61acde20637

SHA1
d5ba42c97488da1910cf3f83a52f7971385642c2

SHA256
8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470

SHA512
63ad2601fb629e74cf60d980cec292b6e8349615996651b7c7f68991cdae5f89b28c11adb77720d7dbbd7700e55fdd5330a84b4a146386cf0c0418a8d61a8a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\base_library.zip

Filesize
767KB

MD5
566017486a592241edeba9983f84ff82

SHA1
fb8008d48d6be46272f11488a0282a861d55a834

SHA256
8df089ca192809420b2425e27dabb50a5d7789ac4a7d62469715004fa692ed0a

SHA512
1358a59c714aa242be66eec7fa03ee55e36b1631f6abd2060424e2e5333b4db4d208a25413bad0210b5ffa88c3e01cbc6d3f99642bcd7fc2aa36e600986104fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\file.exe.manifest

Filesize
1KB

MD5
9d75af9a23adce751bb9a632ef96850f

SHA1
e3b6b477616d122909e2f82c123be099d48a20ed

SHA256
ba5c9a4c0311f9768153150df44fcbda10f13b0706e018840b104f305625f06c

SHA512
b99122b01dc144ddb0deb2cfe356be58f95cf2d6edd45e3b80fd54bccd922aa72303717517bde6e948bee4178ab34bcb8f0f612ba88812b0fda531f91a8ae64c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-1_1.dll

Filesize
768KB

MD5
9b88ff38be61e80eb92708b9f99582aa

SHA1
ed849fc0f66792c424fa4e9b4b791150bcb22a2f

SHA256
cb9778da3b5b42cb79633bcbcc6478435b6013102f02f4f762b7d53cb30a176c

SHA512
f2163297a637e3d3415dcaea5433dc27666850ec5873e4298c87ff17cbe21072176d1dae7441609003a66f7aa336e09654f012dbd89a92d76e371da14ffaf936

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-1_1.dll

Filesize
549KB

MD5
41711f18d198de949bf40a3a84c59996

SHA1
326d102f9e0c751c986a948c90abbbe1ae27b862

SHA256
5d35f6edaa60dc835c0f7879d9bc431304d7a8c4192382f3ba523f02ae033f40

SHA512
2b50f4bc570ea0a46f5032fd3d3c138570d0f8c05b49379f98ea6b0a1724a13008c1a55b64a98e5b1ae45a08e6debad9364c55d055cff7ba296feca69cc411b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-1_1.dll

Filesize
583KB

MD5
6657667c732ac1a4ba87ac8e61c61483

SHA1
ac42576bef9d8df3ce1fd40499163fddedcbf819

SHA256
b8560bc6ec4bfd833514b39d52cd38771f8b37b901f3bd0fc3680c49fc86e324

SHA512
7c63bcec10e92e451288ea5421941b3f1b4472ccdf74cf586e8351c60b32d9eafc015875b8f03f538525980518a1aed05b9ec94295364eee1a39b21d5a8c40a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libssl-1_1.dll

Filesize
499KB

MD5
c8bf8b2133f7e46a9ff9d1d2c0927b0e

SHA1
517fe902a5486ae45aeea208e69e76966737c9fc

SHA256
cf769106d48ff36a334b55ddd7846f675f6dcad6cc95f3d61d085104545a0649

SHA512
3f1822b9e976fb4d11e6ebf8509a6b29f868a54cd97f117e9ebe795c5eb0623cce1c46b457e1c6d3c0a5df546d16535706674a18f1072e0437f2db4c621fbd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\python39.dll

Filesize
2.9MB

MD5
34438f23cba0d031b84f75dd7ba05155

SHA1
48af89139d859e7e43531a1414631093c94a710f

SHA256
f78510ab5767d4cfe98b5d22875bef82ca740466fd8b8172f9b722ed0ab5249e

SHA512
a7999ec33bd5665836776785276737b9a4460b27572cff570c5150bf76c05f19b108f9ca48c3bfb34baca50bb199964b0cfdfd80e2d837f6d99e7489d6c9469a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\python39.dll

Filesize
1.6MB

MD5
ca526b2f387fcdaf99a2cc99ac069703

SHA1
a90bcaa94ed18ddaa8cab1125a007baef239c33a

SHA256
fb6ee7bc5bca2845b02f307c73815d6ac3da0ae2f60c54bf69ce2a0f8d65f922

SHA512
446c58c91219c896a08d62d8267d51247faea921a16f5a2454026b9cd2375ecb9ebff362ae9e171b00619365a5db390519db109fa0f49d180b88a9c1479536c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\select.pyd

Filesize
26KB

MD5
7a442bbcc4b7aa02c762321f39487ba9

SHA1
0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

SHA256
1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

SHA512
3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\unicodedata.pyd

Filesize
1.1MB

MD5
8320c54418d77eba5d4553a5d6ec27f9

SHA1
e5123cf166229aebb076b469459856a56fb16d7f

SHA256
7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae

SHA512
b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nitros.txt

Filesize
4KB

MD5
72a9115f3b71734cc04c9d56c118d6f6

SHA1
d2e2e079ececc176a07104e99343e586e972fa87

SHA256
20d45cbcf1c19dc18d12fe1a343f644a47cdc029fd6d6de3ec4f13fd9585381f

SHA512
4a0c0a862d7675639e18b0d5ae1e4d5a77838c40c0450e744b88d54c14886c94dc2bfb0097c64a3199eef0c6f1afe4f349808485cdd90585f605055d3574abac

Download Submit
memory/4872-1016-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-988-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-994-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1004-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1014-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1032-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1030-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1028-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1026-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1024-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1022-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1020-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1018-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1012-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1010-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-992-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-990-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1002-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-986-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-984-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-982-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-980-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-976-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-974-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-972-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1006-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1008-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-996-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-1000-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-998-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-978-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-970-0x000001948B0F0000-0x000001948B0F1000-memory.dmp

Filesize
4KB

Download
memory/4872-969-0x000001948B0E0000-0x000001948B0E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads