rhadamanthys | hxxps://github[.]com/sapperalfaboy7/nitrogen-v3/releases/tag/Download

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/sapperalfaboy7/nitrogen-v3/releases/tag/Download

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5972 created 2388	5972	RegAsm.exe	41

Executes dropped EXE 1 IoCs

pid	Process
2280	nitro.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 5972	2280	nitro.exe	131

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3264	5972	WerFault.exe	131
928	5972	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5484	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1660	msedge.exe
1660	msedge.exe
1744	identity_helper.exe
1744	identity_helper.exe
5396	msedge.exe
5396	msedge.exe
5972	RegAsm.exe
5972	RegAsm.exe
6088	dialer.exe
6088	dialer.exe
6088	dialer.exe
6088	dialer.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	5644	7zG.exe
Token: 35	5644	7zG.exe
Token: SeSecurityPrivilege	5644	7zG.exe
Token: SeSecurityPrivilege	5644	7zG.exe
Token: SeDebugPrivilege	2124	taskmgr.exe
Token: SeSystemProfilePrivilege	2124	taskmgr.exe
Token: SeCreateGlobalPrivilege	2124	taskmgr.exe
Token: 33	2124	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2124	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
5644	7zG.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe
2124	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4036	1660	msedge.exe	84
PID 1660 wrote to memory of 4036	1660	msedge.exe	84
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 4472	1660	msedge.exe	85
PID 1660 wrote to memory of 1980	1660	msedge.exe	86
PID 1660 wrote to memory of 1980	1660	msedge.exe	86
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87
PID 1660 wrote to memory of 4520	1660	msedge.exe	87

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2388
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/sapperalfaboy7/nitrogen-v3/releases/tag/Download
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce37046f8,0x7ffce3704708,0x7ffce3704718
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4771538217526027958,9048395708364696838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5516

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NitroGen\" -spe -an -ai#7zMap15346:78:7zEvent5636
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5620

C:\Users\Admin\Downloads\NitroGen\nitro.exe
"C:\Users\Admin\Downloads\NitroGen\nitro.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 616
    3⤵
    - Program crash
    PID:3264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 608
    3⤵
    - Program crash
    PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 5972 -ip 5972
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5972 -ip 5972
1⤵
PID:3652

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\StructuredQuery.log
1⤵
- Opens file in notepad (likely ransom note)
PID:5484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
58b807ebf769cdf858643f42860459e5

SHA1
026efffd83c3b018757d56befbc1a1b8e453df53

SHA256
42edab2af68e37ca22fa65b18390499f587892900ea49bbc22398f16afe0ac54

SHA512
df1db7fb1fbeaea24f6bc2e0e53a2ffdc67a732bf7c50a4ca126c1d6ad1ecf5b7dc10cca56322f9d5d025dc98c4a16f1468c7d75f495d677b78dfb886b7c5c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
2ff4b0a28cbb1d79ad892d29eff5a289

SHA1
610ad5f22ba0b14005becaf3fe50512ed011fde4

SHA256
8684f55e8c85397e73ab1714db4ea03eacbd1299de8cd35bef22c687ea791785

SHA512
f91f60d325396329c1b6bc944b317b2a0d67f92c9dab1dd91a114054b1674ede3adb28319acdeb6d254c3a51ab8b016afbc42bf7665015e8f70038ce77434189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4da0bc7cf63ed2446f7c905bb01fa8c9

SHA1
cae73bff50b9d30f30246bd904b8090942daba58

SHA256
70ea0ceb39670034aa4a60159500ccb3c26479ec88414c931d9c2e69d774a100

SHA512
9bc1c0fc90c73ce7ce623aadce0da808278c4fb9fb0514acfd3faaef2446e2a599661aef0c1651216673d696ecb98edc59e14cdf22866b42715eb3aae12dfdec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b877fcc1f03b4f88b40fb4df930b679d

SHA1
87c1362029f4c1a7e4725ef576b17cca8a384dde

SHA256
ed976aa144eb5759efbd96cfb15d295232f9d37e57d50b00f947eba6c0d6eb33

SHA512
281825d28028677fc812957a3f270ece60123a54464bb8631b7620d006298ac3ac6a1d8c10c12d7e30a250d761d78901caf2eecd798d6c0158be7957393bbf6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
201d6d7a7b1645c4a52d9b0aca351549

SHA1
03065a49b2aea502295e91d6f5e0960a7953c6a4

SHA256
888248f02f979781b45a02a5e2897632c59fdd92656cab82f411820d99185e31

SHA512
2855abc132d513fd126e7f6af64357e1cdf302a7df52815777eae416b75e7444de1324e3306be1d88e30331f88a14a3def5139344d70525b9f305b6bd7797d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
4b66a28f9c8c4014eee2e3aa4a7be5c5

SHA1
f4c010d8dbfdae2bd7e2156115d91c41405932b9

SHA256
fcf155822a6915ad626eb82a6ea6bb1c5e2e84d6282cb2cab5a8c265d26675c7

SHA512
086fd294343477284c72f207158ce8c6fcffddfef9d97045058543b8cd7bcba0a0ce117de69ddf354ead0f774b58d569835375cf0d2e3d25e5baa2f46f29bab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582313.TMP

Filesize
874B

MD5
923f9c6e7458c4a42114b802e74d34ea

SHA1
0dbd6d5ca5a61bc0522b6cffdf39eefc6568a025

SHA256
c4a8484e37ac4bc24d820fd4d4afe2f2687cb30ed451522166957ab6dac0ffe0

SHA512
ddc89650aabfbc273d772320287435eae0288681f71212996aef5a50086d22fa7b06da7231a5456823955a3d9ae741cd4a29c9ffe16065e9dd25ee75ef65ece0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
17f837850fa6ea87dc1a5826d441a25b

SHA1
f76597420affd3ee1b737a1117abd2e198ec2432

SHA256
b805c8bbfb90305440d364e7c51bae249dff4fe29f9950b86a97175d201c4b49

SHA512
ec427cb4e704aeb89b4b8961354af43eb7c99af3cc15b256e1e3290bd9be5ac8a58e6090b4897c58d10020ab2893383bc6dc0135c370db10d92b458390c4cf35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e9c7504187abe8e5ecc52005f88029d

SHA1
e9dac5b9457f5c931fbfff0f4bd933ffdf65a46f

SHA256
8ef6916df1462f3f850ae96367831ad8ad3a7e461cfa5079d84c5583656c8b9e

SHA512
bac81b731448f10c16b821ffe7dcc92c35472fc8a4c620682a4d7cadb40428abb8760f455a68b111aeb38842562ed54408085a3ef97c5d4e9a4dc61e54543c6b

Download Submit
C:\Users\Admin\Downloads\NitroGen\nitro.exe

Filesize
448KB

MD5
247e118fea545a3c2fe66e2f6cbb909e

SHA1
9b3111d641b4d298c1929bb854fe625dce04a31e

SHA256
fb60104722bd3e978deb9f646a66c645669b56976f3860422151936945104b0d

SHA512
339d33716e0906b40ec99e959f364681af828d9e4c6756955ca20d4bd309ce534e77593d9e662fbf15b848f480dcd6ca73d94407499b067e1984d0070af96078

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 626242.crdownload

Filesize
8.3MB

MD5
ede1266566f1f5b72445b54fdd777871

SHA1
03174101545f6d9b39a39628c851ff217fbf23a2

SHA256
587322c9740d55c91f25992cdfa74bea19ee360e2c435a2bc099f02605166dc6

SHA512
5ee0d863d74d407b196ac3480e0921ef77c0c084a626e85cb0c16c2b09ef62c1d831debc87b4a0b6c5d7d71e3e778c7e5acad8d374eb922a55589f66794f2829

Download Submit
memory/2124-333-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-335-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-340-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-341-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-342-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-343-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-344-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-345-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-339-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2124-334-0x00000189A0550000-0x00000189A0551000-memory.dmp

Filesize
4KB

Download
memory/2280-313-0x0000000000CF0000-0x0000000000D66000-memory.dmp

Filesize
472KB

Download
memory/5972-316-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5972-324-0x0000000076620000-0x0000000076835000-memory.dmp

Filesize
2.1MB

Download
memory/5972-322-0x00007FFCF1950000-0x00007FFCF1B45000-memory.dmp

Filesize
2.0MB

Download
memory/5972-321-0x00000000037F0000-0x0000000003BF0000-memory.dmp

Filesize
4.0MB

Download
memory/5972-320-0x00000000037F0000-0x0000000003BF0000-memory.dmp

Filesize
4.0MB

Download
memory/5972-319-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6088-330-0x0000000076620000-0x0000000076835000-memory.dmp

Filesize
2.1MB

Download
memory/6088-328-0x00007FFCF1950000-0x00007FFCF1B45000-memory.dmp

Filesize
2.0MB

Download
memory/6088-327-0x0000000002450000-0x0000000002850000-memory.dmp

Filesize
4.0MB

Download
memory/6088-325-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download