Overview
overview
9Static
static
3nazimodpc-v3.5.zip
windows10-1703-x64
9nazimodpc-v3.5.zip
windows10-2004-x64
1nazimod-loader.exe
windows10-1703-x64
1nazimod-loader.exe
windows10-2004-x64
1nazimod-log.txt
windows10-1703-x64
1nazimod-log.txt
windows10-2004-x64
1nazimod-runtime.dll
windows10-1703-x64
1nazimod-runtime.dll
windows10-2004-x64
1Analysis
- max time kernel
1797s - max time network
1588s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
15/08/2024, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
nazimodpc-v3.5.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
nazimodpc-v3.5.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
nazimod-loader.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
nazimod-loader.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
nazimod-log.txt
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
nazimod-log.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
nazimod-runtime.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
nazimod-runtime.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target nazimod-loader.exe
- Size 133KB
- Sample240815-1edflswbla
- SHA256 e7999975233ccb9ade894b5a6a79ba1b62b321b270bc879274852f05a4e154f3
- MD5 547ad33fd7233cfaccaca04c8b2b4d02
- SHA1 115ba523b091dc9d8f5d223a3eeca9db1b8e2805
- SHA512 56e84f1ce179ae7db42bb288591de952fbd80a1c0a19e0aacf9aded80477e5ba57333fd0259233a368a1b0d0d92ace05ae4b6813000a6eec83ad4fe36c9d6799
- SSDEEP 3072:jnN7O9r9fDpv72LhyZ8YKe6eO/uoDbvJAXphZBXwpg8bUgg:cPe+2bvaphPwpg8A
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings nazimod-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe 824 nazimod-loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1760 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nazimod-loader.exe"C:\Users\Admin\AppData\Local\Temp\nazimod-loader.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:824
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1760