Overview
overview
7Static
static
3GANG-Nuker.zip
windows7-x64
1GANG-Nuker.zip
windows10-2004-x64
1GANG-Nuker/GANG.exe
windows7-x64
7GANG-Nuker/GANG.exe
windows10-2004-x64
7GANG.pyc
windows7-x64
3GANG.pyc
windows10-2004-x64
3GANG-Nuker...nt.txt
windows7-x64
1GANG-Nuker...nt.txt
windows10-2004-x64
1GANG-Nuker...NG.png
windows7-x64
3GANG-Nuker...NG.png
windows10-2004-x64
3GANG-Nuker...ker.py
windows7-x64
3GANG-Nuker...ker.py
windows10-2004-x64
3GANG-Nuker...gin.py
windows7-x64
3GANG-Nuker...gin.py
windows10-2004-x64
3GANG-Nuker...ter.py
windows7-x64
3GANG-Nuker...ter.py
windows10-2004-x64
3GANG-Nuker...ber.py
windows7-x64
3GANG-Nuker...ber.py
windows10-2004-x64
3GANG-Nuker...kup.py
windows7-x64
3GANG-Nuker...kup.py
windows10-2004-x64
3GANG-Nuker...nfo.py
windows7-x64
3GANG-Nuker...nfo.py
windows10-2004-x64
3GANG-Nuker...ore.py
windows7-x64
3GANG-Nuker...ore.py
windows10-2004-x64
3GANG-Nuker...mon.py
windows7-x64
3GANG-Nuker...mon.py
windows10-2004-x64
3GANG-Nuker...rys.py
windows7-x64
3GANG-Nuker...rys.py
windows10-2004-x64
3GANG-Nuker...ate.py
windows7-x64
3GANG-Nuker...ate.py
windows10-2004-x64
3GANG-Nuker...ersion
windows7-x64
1GANG-Nuker...ersion
windows10-2004-x64
1Analysis
-
max time kernel
1801s -
max time network
1816s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 14:48
Behavioral task
behavioral1
Sample
GANG-Nuker.zip
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
GANG-Nuker.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
GANG-Nuker/GANG.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
GANG-Nuker/GANG.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
GANG.pyc
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
GANG.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
GANG-Nuker/data/useragent.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
GANG-Nuker/data/useragent.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
GANG-Nuker/utilities/Avatars/GANG.png
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
GANG-Nuker/utilities/Avatars/GANG.png
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
GANG-Nuker/utilities/Plugins/Account_Nuker.py
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
GANG-Nuker/utilities/Plugins/Account_Nuker.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
GANG-Nuker/utilities/Plugins/Auto_Login.py
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
GANG-Nuker/utilities/Plugins/Auto_Login.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
GANG-Nuker/utilities/Plugins/DM_Deleter.py
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
GANG-Nuker/utilities/Plugins/DM_Deleter.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
GANG-Nuker/utilities/Plugins/QR_Grabber.py
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
GANG-Nuker/utilities/Plugins/QR_Grabber.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
GANG-Nuker/utilities/Plugins/Server_Lookup.py
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
GANG-Nuker/utilities/Plugins/Server_Lookup.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
GANG-Nuker/utilities/Plugins/Token_Info.py
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
GANG-Nuker/utilities/Plugins/Token_Info.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
GANG-Nuker/utilities/Plugins/ignore/ignore.py
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
GANG-Nuker/utilities/Plugins/ignore/ignore.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
GANG-Nuker/utilities/Settings/common.py
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
GANG-Nuker/utilities/Settings/common.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
GANG-Nuker/utilities/Settings/libarys.py
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
GANG-Nuker/utilities/Settings/libarys.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
GANG-Nuker/utilities/Settings/update.py
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
GANG-Nuker/utilities/Settings/update.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
GANG-Nuker/utilities/Settings/version
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
GANG-Nuker/utilities/Settings/version
Resource
win10v2004-20240426-en
General
-
Target
GANG-Nuker/utilities/Plugins/Auto_Login.py
-
Size
2KB
-
MD5
5f1e03d33dc4f2c1d78a0109c5778550
-
SHA1
a6f44af43b5a45938fa77aba6414b476d6813023
-
SHA256
e9a3d79a5c3216e169a1451c6e899085940f72f94fe263ecd3a9739f4c650b1f
-
SHA512
316b33dee5fb95c999589f1b7f3319f64a6b4d17fc03f3b731cbecd15b6165894a6a61038c98856f467400769223255625ba6781749d175235b180a923e232d1
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2880 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2880 AcroRd32.exe 2880 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1740 wrote to memory of 2680 1740 cmd.exe rundll32.exe PID 1740 wrote to memory of 2680 1740 cmd.exe rundll32.exe PID 1740 wrote to memory of 2680 1740 cmd.exe rundll32.exe PID 2680 wrote to memory of 2880 2680 rundll32.exe AcroRd32.exe PID 2680 wrote to memory of 2880 2680 rundll32.exe AcroRd32.exe PID 2680 wrote to memory of 2880 2680 rundll32.exe AcroRd32.exe PID 2680 wrote to memory of 2880 2680 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\GANG-Nuker\utilities\Plugins\Auto_Login.py1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GANG-Nuker\utilities\Plugins\Auto_Login.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GANG-Nuker\utilities\Plugins\Auto_Login.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD55d05fa8bcd40949ac0883c921dce08db
SHA14edab0c7cacb43ff92fb59e66bc8c4c4aa4b00b4
SHA2569d246507b72832970f13013be9239b2d74468a8337cde936c1662dabd8e664a9
SHA51246ee2fad49ff076050fd517d581a06c17baee88a379f6d14478c1b1c2256a8f5a394935a69d7f05132e5c0f62191cd7ed20fbe8f2e3e6f5766a00a9a79267552