f54f80a78ea0965ff247b3d9400cd2a82d5f1a2c4ee82305e110939890eb76f8

Analysis

max time kernel
1558s
max time network
1560s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/08/2024, 18:23

Target

NitroGenX/NitroGenX.exe
Size

8.2MB
MD5

6327ad7bf64a76aae045796c00dfdba8
SHA1

da6fccd10bef61e1cdaa20b027da6e9095e15779
SHA256

c7a23098dec00a060fc678ba01f7f9744b2a2133ec7e70587203a97af51ceeca
SHA512

55e0b145269de24a7daa77c62df3f965b8059a33e02e3296d5349eb3ca77593328fc05477bcc81d21f714f50f3d2401e8b8b94de0ff2ef4201df8058fe4ba54b
SSDEEP

196608:MEUXDB2MNvmWiOjmFh7RxtYSHdK5kdai7bN3m2R8Rq0gFl7PP:cX19KlpXB3QnAz7X

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3032	NitroGenX.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195c7-28.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3032	2624	NitroGenX.exe	30
PID 2624 wrote to memory of 3032	2624	NitroGenX.exe	30
PID 2624 wrote to memory of 3032	2624	NitroGenX.exe	30

C:\Users\Admin\AppData\Local\Temp\NitroGenX\NitroGenX.exe
"C:\Users\Admin\AppData\Local\Temp\NitroGenX\NitroGenX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\NitroGenX\NitroGenX.exe
  "C:\Users\Admin\AppData\Local\Temp\NitroGenX\NitroGenX.exe"
  2⤵
  - Loads dropped DLL
  PID:3032

C:\Users\Admin\AppData\Local\Temp\_MEI26242\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/3032-30-0x000007FEF5BA0000-0x000007FEF6006000-memory.dmp

Filesize
4.4MB

Download