cd4d052237893068f83ba8d073f95217dbe96c4a0373cf17427203c796cf6565

Analysis

max time kernel
13s
max time network
17s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NPLoader.exe
Size

11.8MB
MD5

97f3bcb4bbe689cf6c389a655fc1dff9
SHA1

496eb7022d33177493a7600c9a2f8ef7ed262081
SHA256

cd4d052237893068f83ba8d073f95217dbe96c4a0373cf17427203c796cf6565
SHA512

7c42cb431b6e9998911070eb606e0d1e9db56b734f10167d72c15c24ec302c7d8d699035885e6b9ddd1592fa3095e16a2594a000b06a636a7e6fe74481b25981
SSDEEP

196608:gLygabBD8w5H2U3TSj/CzFkBdHtIT2qHNzJPKzTdAGebLqMAp0NMS6AXkrL3XnO7:gegabeAmj/CzFkLNIT2clJSzT6G2Lr6V

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	NPLoader.exe
416	NPLoader.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 1684	416	NPLoader.exe	78
PID 416 wrote to memory of 1684	416	NPLoader.exe	78
PID 1684 wrote to memory of 3564	1684	cmd.exe	79
PID 1684 wrote to memory of 3564	1684	cmd.exe	79
PID 1684 wrote to memory of 1436	1684	cmd.exe	80
PID 1684 wrote to memory of 1436	1684	cmd.exe	80
PID 1684 wrote to memory of 1956	1684	cmd.exe	81
PID 1684 wrote to memory of 1956	1684	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\NPLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NPLoader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\NPLoader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\NPLoader.exe" MD5
    3⤵
    PID:3564
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1436
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-0-0x00007FF6C792D000-0x00007FF6C809C000-memory.dmp

Filesize
7.4MB

Download
memory/416-4-0x00007FFD24500000-0x00007FFD24502000-memory.dmp

Filesize
8KB

Download
memory/416-3-0x00007FFD244F0000-0x00007FFD244F2000-memory.dmp

Filesize
8KB

Download
memory/416-2-0x00007FFD244E0000-0x00007FFD244E2000-memory.dmp

Filesize
8KB

Download
memory/416-1-0x00007FFD244D0000-0x00007FFD244D2000-memory.dmp

Filesize
8KB

Download
memory/416-5-0x00007FFD24510000-0x00007FFD24512000-memory.dmp

Filesize
8KB

Download
memory/416-6-0x00007FFD24520000-0x00007FFD24522000-memory.dmp

Filesize
8KB

Download
memory/416-7-0x00007FFD24530000-0x00007FFD24532000-memory.dmp

Filesize
8KB

Download
memory/416-10-0x00007FFD24560000-0x00007FFD24562000-memory.dmp

Filesize
8KB

Download
memory/416-9-0x00007FFD24550000-0x00007FFD24552000-memory.dmp

Filesize
8KB

Download
memory/416-8-0x00007FFD24540000-0x00007FFD24542000-memory.dmp

Filesize
8KB

Download
memory/416-11-0x00007FFD24570000-0x00007FFD24572000-memory.dmp

Filesize
8KB

Download
memory/416-12-0x00007FFD24580000-0x00007FFD24582000-memory.dmp

Filesize
8KB

Download
memory/416-17-0x00007FFD245D0000-0x00007FFD245D2000-memory.dmp

Filesize
8KB

Download
memory/416-16-0x00007FFD245C0000-0x00007FFD245C2000-memory.dmp

Filesize
8KB

Download
memory/416-15-0x00007FFD245B0000-0x00007FFD245B2000-memory.dmp

Filesize
8KB

Download
memory/416-14-0x00007FFD245A0000-0x00007FFD245A2000-memory.dmp

Filesize
8KB

Download
memory/416-13-0x00007FFD24590000-0x00007FFD24592000-memory.dmp

Filesize
8KB

Download
memory/416-18-0x00007FFD245E0000-0x00007FFD245E2000-memory.dmp

Filesize
8KB

Download
memory/416-26-0x000001FC6A620000-0x000001FC6A63A000-memory.dmp

Filesize
104KB

Download
memory/416-20-0x000001FC68DD0000-0x000001FC68E5E000-memory.dmp

Filesize
568KB

Download
memory/416-19-0x00007FFD245F0000-0x00007FFD245F2000-memory.dmp

Filesize
8KB

Download
memory/416-32-0x000001FC68DD0000-0x000001FC68E5E000-memory.dmp

Filesize
568KB

Download
memory/416-37-0x00007FF6C78C0000-0x00007FF6C8C76000-memory.dmp

Filesize
19.7MB

Download
memory/416-34-0x000001FC6A650000-0x000001FC6A659000-memory.dmp

Filesize
36KB

Download
memory/416-33-0x000001FC6A620000-0x000001FC6A63A000-memory.dmp

Filesize
104KB

Download
memory/416-40-0x00007FF6C792D000-0x00007FF6C809C000-memory.dmp

Filesize
7.4MB

Download