Overview
overview
7Static
static
3NLBrute 1....en.zip
windows7-x64
1NLBrute 1....en.zip
windows10-2004-x64
1NLBrute 1....en.exe
windows7-x64
5NLBrute 1....en.exe
windows10-2004-x64
5NLBrute 1....64.exe
windows7-x64
5NLBrute 1....64.exe
windows10-2004-x64
5NLBrute 1....32.dll
windows7-x64
1NLBrute 1....32.dll
windows10-2004-x64
1masScan_1.6/Input.txt
windows7-x64
1masScan_1.6/Input.txt
windows10-2004-x64
5masScan_1....UI.exe
windows7-x64
1masScan_1....UI.exe
windows10-2004-x64
1masScan_1....et.dll
windows7-x64
1masScan_1....et.dll
windows10-2004-x64
1masScan_1...._3.exe
windows7-x64
7masScan_1...._3.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.ini
windows7-x64
1$PLUGINSDI...ns.ini
windows10-2004-x64
1$PLUGINSDI...al.ini
windows7-x64
1$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows7-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$SYSDIR/Packet.dll
windows7-x64
1$SYSDIR/Packet.dll
windows10-2004-x64
1$SYSDIR/pthreadVC.dll
windows7-x64
1$SYSDIR/pthreadVC.dll
windows10-2004-x64
1$SYSDIR/wpcap.dll
windows7-x64
1$SYSDIR/wpcap.dll
windows10-2004-x64
1Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2024 09:07
Static task
static1
Behavioral task
behavioral1
Sample
NLBrute 1.2 x64 & VPN - KeyGen.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
NLBrute 1.2 x64 & VPN - KeyGen.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64 & VPN - KeyGen.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64 & VPN - KeyGen.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
NLBrute 1.2 x64 & VPN - KeyGen/libeay32.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
NLBrute 1.2 x64 & VPN - KeyGen/libeay32.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
masScan_1.6/Input.txt
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
masScan_1.6/Input.txt
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
masScan_1.6/Massscan_GUI.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
masScan_1.6/Massscan_GUI.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
masScan_1.6/Packet.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
masScan_1.6/Packet.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
masScan_1.6/WinPcap_4_1_3.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
masScan_1.6/WinPcap_4_1_3.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/bootOptions.ini
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/bootOptions.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
$SYSDIR/Packet.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
$SYSDIR/Packet.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
$SYSDIR/pthreadVC.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$SYSDIR/pthreadVC.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
$SYSDIR/wpcap.dll
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
$SYSDIR/wpcap.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/modern-header.bmp
-
Size
29KB
-
MD5
d8f59a707b2a5000c7903595eddc3d48
-
SHA1
e86239fe1dc3cfdbec6006817160eb5f1fc92bca
-
SHA256
c0e284fde834fe8a6f90504dba7abff25b1e7dd4611483341203fd3efc5de8a6
-
SHA512
91e28a685733620832d3851d7f3eee36495f2728610bd6c66f305cdda039f75ab8499d0e51e64afa018c221a728889503db2fc7c84cf9599a61b68951686b048
-
SSDEEP
192:UdCd/28k2hZrlQ+jP3/PGs/ZkTnSQpuWE:UD8jLlQ+jP3///ZUSJ5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid process 228 mspaint.exe 228 mspaint.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
mspaint.exepid process 228 mspaint.exe 228 mspaint.exe 228 mspaint.exe 228 mspaint.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 3464 wrote to memory of 228 3464 cmd.exe mspaint.exe PID 3464 wrote to memory of 228 3464 cmd.exe mspaint.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2044