Overview

overview

10

Static

static

10

319218e4eb...e3.exe

windows7-x64

10

319218e4eb...e3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • submitted
    18-06-2024 17:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    319218e4eb0d6637a76668a228e32de3.exe

  • Size

    144KB

  • MD5

    319218e4eb0d6637a76668a228e32de3

  • SHA1

    20523303d722a7747deb6154a5d4401e1b932d56

  • SHA256

    3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358

  • SHA512

    db3d1637c178bdf3c8c5b754fe72c388a3da176b2d0a7727e89f2c257bcb93b1574eda1de7f6ea25e493949f47157c07637fbe1169fe6c9481cc42d925293fe6

  • SSDEEP

    3072:HGNhvhNC38S7gzQ/cmD4ULz82nyLOLt/w/HOWJbG5vcX+skwEKEAm31D5:EzQ/2my2w/uWJbGFsREKQ1

Score
10/10
nightingalecredential_accessexecutionpersistencespywarestealer

Malware Config

Extracted

Family

nightingale

C2

185.196.8.223:3999

https://api.telegram.org/bot6813766312:AAGyxmK0E-SiPNsQCpjEIFZJIOhZnrPLxhw/sendMessage?chat_id=6467170572

Signatures

  • Nightingale family
    nightingale
  • Nightingale stealer

    Nightingale stealer is an information stealer written in C#.

    stealernightingale
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\319218e4eb0d6637a76668a228e32de3.exe
    "C:\Users\Admin\AppData\Local\Temp\319218e4eb0d6637a76668a228e32de3.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\319218e4eb0d6637a76668a228e32de3.exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\319218e4eb0d6637a76668a228e32de3.exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4768
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5092
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      64B

      MD5

      50a8221b93fbd2628ac460dd408a9fc1

      SHA1

      7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

      SHA256

      46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

      SHA512

      27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1kfhzmyq.nqb.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/4524-1-0x00007FFEC0D73000-0x00007FFEC0D75000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4524-2-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4524-0-0x000001C746CD0000-0x000001C746CFA000-memory.dmp

      Filesize

      168KB

      Download

    • memory/4524-34-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4524-32-0x00007FFEC0D73000-0x00007FFEC0D75000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4524-31-0x000001C7614C0000-0x000001C761669000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/4768-3-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4768-30-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4768-11-0x0000024A6F0B0000-0x0000024A6F0D2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4768-5-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4768-4-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

      Filesize

      10.8MB

      Download