Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 08:15
Behavioral task
behavioral1
Sample
nitrogenerator.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
nitrogenerator.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
nitrogenerator.exe
Resource
win10v2004-20240508-en
General
-
Target
nitrogenerator.exe
-
Size
14.6MB
-
MD5
33a496b490d98cad6a3d59126256ce30
-
SHA1
e43dfdf43ec64bf4ff7ec9d540518cb9de2e9e66
-
SHA256
441a7617caf3bdd8f1c0623d9bfc9a0c4c67354f5b94cbcb2fb75941222569c6
-
SHA512
2e91cd3e3f16b275f493222b6c159f14e51e6239623411935d73cc6cf60b9eb5ab7f407bdcf0038e03b0ebdce2399166c3c1621d766296a392a825bfb51c7320
-
SSDEEP
393216:uXySXzTo9Hk3meplcGfd9YMMjowUIoL682j:uiSPoJa15F9Y5Uh2z
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2836 nitrogenerator.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2836 2208 nitrogenerator.exe 29 PID 2208 wrote to memory of 2836 2208 nitrogenerator.exe 29 PID 2208 wrote to memory of 2836 2208 nitrogenerator.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\nitrogenerator.exe"C:\Users\Admin\AppData\Local\Temp\nitrogenerator.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\nitrogenerator.exe"C:\Users\Admin\AppData\Local\Temp\nitrogenerator.exe"2⤵
- Loads dropped DLL
PID:2836
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081