7d1e94147b1cb92a59e80204e6297c87fc1bdc7618e173cfb3074561bdfe7213 | Triage

Analysis

max time kernel
47s
max time network
17s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 10:35

Sharing

Report Analysis Logs

General

Target

NitroGenerator.exe
Size

14.6MB
MD5

9be718b54751c32bd3c45de8fc5a3f8b
SHA1

d211f4b16c560a74efbaf311d4e7ffa6921b75ee
SHA256

7d1e94147b1cb92a59e80204e6297c87fc1bdc7618e173cfb3074561bdfe7213
SHA512

7057e3808a612e64a7eb7f70657e42cd3fae6d874c2f7b50eb7167472059f1fd40258a42f4d5b6e2b01c6c551946461c1f745a4cb249a2d27157d68d63f3e540
SSDEEP

393216:HFEkZQMidQuslSq99oWOv+9fgdigq8Evx:HFhQ3dQuSDorvSYdTEv

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2500	NitroGenerator.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2500	1924	NitroGenerator.exe	28
PID 1924 wrote to memory of 2500	1924	NitroGenerator.exe	28
PID 1924 wrote to memory of 2500	1924	NitroGenerator.exe	28

C:\Users\Admin\AppData\Local\Temp\NitroGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\NitroGenerator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\NitroGenerator.exe
  "C:\Users\Admin\AppData\Local\Temp\NitroGenerator.exe"
  2⤵
  - Loads dropped DLL
  PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19242\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit