Resubmissions

09-08-2024 07:54

240809-jrq4sssbja 10

09-08-2024 07:41

240809-jja3lsxhkr 10

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09-08-2024 07:41

General

  • Target

    NurusltanCrack.exe

  • Size

    32.4MB

  • MD5

    5c5aa0a513a8ae042060f8bf4df0f5ec

  • SHA1

    35b7d79ff18b63e9f1ddd0f0912ae6cbdc06e018

  • SHA256

    6598924e8f1aeff9b6b1326299e5fc98886b253d43530917fe1ca41a4c244a19

  • SHA512

    16b502d9e2a7336f387eea196d824b9a6a9cd50266313b3ab2667b3c1ace16f7fb5db22b141d897cd515cf0ba292e243d768e3fcc3eaa0d233b45053d544d371

  • SSDEEP

    786432:Sq/+w/Up2g3xh7mw4cctICOuKq8G+fKb3o1ixNpd:Sq/Hsp2oT7N4NtICOuR7gk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NurusltanCrack.exe
    "C:\Users\Admin\AppData\Local\Temp\NurusltanCrack.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\onefile_2400_133676628974616000\NurusltanCrack.exe
      C:\Users\Admin\AppData\Local\Temp\NurusltanCrack.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_2400_133676628974616000\python311.dll

    Filesize

    5.5MB

    MD5

    9a24c8c35e4ac4b1597124c1dcbebe0f

    SHA1

    f59782a4923a30118b97e01a7f8db69b92d8382a

    SHA256

    a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

    SHA512

    9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

  • memory/2400-183-0x000000013FC90000-0x0000000141D1F000-memory.dmp

    Filesize

    32.6MB

  • memory/2680-94-0x000000013F4E0000-0x0000000143618000-memory.dmp

    Filesize

    65.2MB