858ff0e6cd73fb2fc697e98f99ad5f9bd4de08a2a66f9a8b96267e169ecfc381

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Atlantis Nova/Atlantis.exe
Size

421KB
MD5

12f106cd65f9c6af13d14081eaa7e205
SHA1

6eeaba50103a88c666b1d94a6119332968c7b2bd
SHA256

22f7e042f74c9a15b672573ef5f434861486cd5b1ff16ecb1f45858540b0a4ad
SHA512

dab3b379748309845113328911040f58795086f27f2564fc8a4197559a77db05853440da5c0f24cefd5d52bca96158068eb90a2ffa40adda65d687ee68f3ad4f
SSDEEP

12288:mWQ9xExurrTbVi+ATMJfZjGLiHBRXDoToLoS:/QfsA7Vi+8cfNWiHDzo8

Score

8^/10

upx

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2316	rundll32.exe
7	2316	rundll32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral5/memory/2372-0-0x0000000000400000-0x000000000052A000-memory.dmp	upx
behavioral5/memory/2372-4-0x0000000000400000-0x000000000052A000-memory.dmp	upx
behavioral5/memory/2372-11-0x0000000000400000-0x000000000052A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\OOBGameInstalled = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\ServiceLocation	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	Atlantis.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28
PID 2372 wrote to memory of 2316	2372	Atlantis.exe	28

C:\Users\Admin\AppData\Local\Temp\Atlantis Nova\Atlantis.exe
"C:\Users\Admin\AppData\Local\Temp\Atlantis Nova\Atlantis.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {0ec4a233-e49b-47dc-9883-c26cebaffaaf};C:\Users\Admin\AppData\Local\Temp\Atlantis Nova\Atlantis.exe;2372
  2⤵
  - Blocklisted process makes network request
  - Modifies registry class
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-2-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2316-6-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2372-0-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2372-4-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2372-7-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2372-11-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2372-13-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download