b671f420afcc25cd5b00b9b32c7cbad7b0ad7410354a133f246469f7c0414016

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NingaliNET 1.0.2.1/Server.exe
Size

149KB
MD5

23886459c4790697a4f0bf60b8d9235f
SHA1

072e005df5322bb3b094be6fc5366ba223bf3849
SHA256

de60420ce7dfbf87168d5124dfd82c16c2d5f54362d2775ec8136a17acb6ab76
SHA512

a6ef16716a755d419a1ad9fbb584256c1e6d3e1aed50b2732ff9b84dfe21d1a1d2aed6d4b8c7aea026e864a1397595b5e66517944a624cf5c68b26910d6aaa12
SSDEEP

3072:q/yjqpkbQBYYppJT3UJwi7RA7tkHIO6AtDbbTU0P7tepGgvJbVf:qp7T3UJwipHIVAFbTBP7tepG8R

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5612398.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5612398.exe	Server.exe

Executes dropped EXE 1 IoCs

pid	Process
2552	Server.exe

Loads dropped DLL 1 IoCs

pid	Process
1072	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\5612398 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5612398 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Server.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Server.exe

Kills process with taskkill 27 IoCs

evasion

pid	Process
1232	taskkill.exe
1524	taskkill.exe
2560	taskkill.exe
1200	taskkill.exe
2628	taskkill.exe
2344	taskkill.exe
1988	taskkill.exe
2692	taskkill.exe
1828	taskkill.exe
1400	taskkill.exe
2428	taskkill.exe
1820	taskkill.exe
2784	taskkill.exe
2600	taskkill.exe
2748	taskkill.exe
2392	taskkill.exe
1884	taskkill.exe
1740	taskkill.exe
488	taskkill.exe
2224	taskkill.exe
792	taskkill.exe
108	taskkill.exe
1964	taskkill.exe
2284	taskkill.exe
2912	taskkill.exe
2328	taskkill.exe
2044	taskkill.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	Server.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	488	taskkill.exe
Token: SeDebugPrivilege	792	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	108	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	2912	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1072	Server.exe
2552	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2552	1072	Server.exe	29
PID 1072 wrote to memory of 2552	1072	Server.exe	29
PID 1072 wrote to memory of 2552	1072	Server.exe	29
PID 1072 wrote to memory of 2552	1072	Server.exe	29
PID 2552 wrote to memory of 2748	2552	Server.exe	30
PID 2552 wrote to memory of 2748	2552	Server.exe	30
PID 2552 wrote to memory of 2748	2552	Server.exe	30
PID 2552 wrote to memory of 2748	2552	Server.exe	30
PID 2552 wrote to memory of 2560	2552	Server.exe	31
PID 2552 wrote to memory of 2560	2552	Server.exe	31
PID 2552 wrote to memory of 2560	2552	Server.exe	31
PID 2552 wrote to memory of 2560	2552	Server.exe	31
PID 2552 wrote to memory of 1740	2552	Server.exe	32
PID 2552 wrote to memory of 1740	2552	Server.exe	32
PID 2552 wrote to memory of 1740	2552	Server.exe	32
PID 2552 wrote to memory of 1740	2552	Server.exe	32
PID 2552 wrote to memory of 1232	2552	Server.exe	36
PID 2552 wrote to memory of 1232	2552	Server.exe	36
PID 2552 wrote to memory of 1232	2552	Server.exe	36
PID 2552 wrote to memory of 1232	2552	Server.exe	36
PID 2552 wrote to memory of 1200	2552	Server.exe	37
PID 2552 wrote to memory of 1200	2552	Server.exe	37
PID 2552 wrote to memory of 1200	2552	Server.exe	37
PID 2552 wrote to memory of 1200	2552	Server.exe	37
PID 2552 wrote to memory of 1400	2552	Server.exe	39
PID 2552 wrote to memory of 1400	2552	Server.exe	39
PID 2552 wrote to memory of 1400	2552	Server.exe	39
PID 2552 wrote to memory of 1400	2552	Server.exe	39
PID 2552 wrote to memory of 2428	2552	Server.exe	42
PID 2552 wrote to memory of 2428	2552	Server.exe	42
PID 2552 wrote to memory of 2428	2552	Server.exe	42
PID 2552 wrote to memory of 2428	2552	Server.exe	42
PID 2552 wrote to memory of 2628	2552	Server.exe	43
PID 2552 wrote to memory of 2628	2552	Server.exe	43
PID 2552 wrote to memory of 2628	2552	Server.exe	43
PID 2552 wrote to memory of 2628	2552	Server.exe	43
PID 2552 wrote to memory of 1828	2552	Server.exe	45
PID 2552 wrote to memory of 1828	2552	Server.exe	45
PID 2552 wrote to memory of 1828	2552	Server.exe	45
PID 2552 wrote to memory of 1828	2552	Server.exe	45
PID 2552 wrote to memory of 488	2552	Server.exe	50
PID 2552 wrote to memory of 488	2552	Server.exe	50
PID 2552 wrote to memory of 488	2552	Server.exe	50
PID 2552 wrote to memory of 488	2552	Server.exe	50
PID 2552 wrote to memory of 792	2552	Server.exe	51
PID 2552 wrote to memory of 792	2552	Server.exe	51
PID 2552 wrote to memory of 792	2552	Server.exe	51
PID 2552 wrote to memory of 792	2552	Server.exe	51
PID 2552 wrote to memory of 1884	2552	Server.exe	53
PID 2552 wrote to memory of 1884	2552	Server.exe	53
PID 2552 wrote to memory of 1884	2552	Server.exe	53
PID 2552 wrote to memory of 1884	2552	Server.exe	53
PID 2552 wrote to memory of 108	2552	Server.exe	56
PID 2552 wrote to memory of 108	2552	Server.exe	56
PID 2552 wrote to memory of 108	2552	Server.exe	56
PID 2552 wrote to memory of 108	2552	Server.exe	56
PID 2552 wrote to memory of 2392	2552	Server.exe	57
PID 2552 wrote to memory of 2392	2552	Server.exe	57
PID 2552 wrote to memory of 2392	2552	Server.exe	57
PID 2552 wrote to memory of 2392	2552	Server.exe	57
PID 2552 wrote to memory of 1820	2552	Server.exe	59
PID 2552 wrote to memory of 1820	2552	Server.exe	59
PID 2552 wrote to memory of 1820	2552	Server.exe	59
PID 2552 wrote to memory of 1820	2552	Server.exe	59

C:\Users\Admin\AppData\Local\Temp\NingaliNET 1.0.2.1\Server.exe
"C:\Users\Admin\AppData\Local\Temp\NingaliNET 1.0.2.1\Server.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Antilogger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
149KB

MD5
23886459c4790697a4f0bf60b8d9235f

SHA1
072e005df5322bb3b094be6fc5366ba223bf3849

SHA256
de60420ce7dfbf87168d5124dfd82c16c2d5f54362d2775ec8136a17acb6ab76

SHA512
a6ef16716a755d419a1ad9fbb584256c1e6d3e1aed50b2732ff9b84dfe21d1a1d2aed6d4b8c7aea026e864a1397595b5e66517944a624cf5c68b26910d6aaa12

Download Submit
memory/1072-0-0x0000000074401000-0x0000000074402000-memory.dmp

Filesize
4KB

Download
memory/1072-1-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/1072-2-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/1072-3-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/1072-11-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-13-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-12-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-14-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-15-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-17-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-18-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-19-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-20-0x0000000074400000-0x00000000749AB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads