Analysis
- max time kernel
1779s - max time network
1156s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
16/08/2024, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nazimodpc-v3.5.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
1800 seconds
Behavioral task
behavioral2
Sample
nazimod-loader.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral3
Sample
nazimod-log.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
nazimod-runtime.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
1800 seconds
General
- Target nazimod-loader.exe
- Size 133KB
- Sample240816-xdc7nstfnl
- SHA256 e7999975233ccb9ade894b5a6a79ba1b62b321b270bc879274852f05a4e154f3
- MD5 547ad33fd7233cfaccaca04c8b2b4d02
- SHA1 115ba523b091dc9d8f5d223a3eeca9db1b8e2805
- SHA512 56e84f1ce179ae7db42bb288591de952fbd80a1c0a19e0aacf9aded80477e5ba57333fd0259233a368a1b0d0d92ace05ae4b6813000a6eec83ad4fe36c9d6799
- SSDEEP 3072:jnN7O9r9fDpv72LhyZ8YKe6eO/uoDbvJAXphZBXwpg8bUgg:cPe+2bvaphPwpg8A
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings nazimod-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe 3228 nazimod-loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3136 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nazimod-loader.exe"C:\Users\Admin\AppData\Local\Temp\nazimod-loader.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3228
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3136