Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 02:49

General

  • Target

    Netron.exe

  • Size

    177.4MB

  • MD5

    28c990f895c9a93b77d869763060374b

  • SHA1

    51354e111e2a4bf9c625580ab26bbd2cce41da4f

  • SHA256

    23fd2a12093d151f5e761b657852153937e3e72ac4e6b6385dc2aeaf7af0210c

  • SHA512

    3f9982e94b8c526808cab62e489eae2467ca162b7afee40df05f9e1ffbfc97a3e1a2785ed8858e7b416066f488235659b633eb185cdcc3f7f2fc92d6ebb5020a

  • SSDEEP

    1572864:L+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnaN:LA5kyGScXQTb

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Netron.exe
    "C:\Users\Admin\AppData\Local\Temp\Netron.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\Netron.exe
      "C:\Users\Admin\AppData\Local\Temp\Netron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1820,i,14821914381475539615,11774605408157066816,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:2
      2⤵
        PID:2344
      • C:\Users\Admin\AppData\Local\Temp\Netron.exe
        "C:\Users\Admin\AppData\Local\Temp\Netron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --field-trial-handle=2176,i,14821914381475539615,11774605408157066816,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
        2⤵
          PID:2100
        • C:\Users\Admin\AppData\Local\Temp\Netron.exe
          "C:\Users\Admin\AppData\Local\Temp\Netron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --app-user-model-id=com.lutzroeder.netron --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2380,i,14821914381475539615,11774605408157066816,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:5064
        • C:\Users\Admin\AppData\Local\Temp\Netron.exe
          "C:\Users\Admin\AppData\Local\Temp\Netron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Netron" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2432,i,14821914381475539615,11774605408157066816,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4172

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • C:\Users\Admin\AppData\Roaming\Netron\Preferences

        Filesize

        57B

        MD5

        58127c59cb9e1da127904c341d15372b

        SHA1

        62445484661d8036ce9788baeaba31d204e9a5fc

        SHA256

        be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

        SHA512

        8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

      • C:\Users\Admin\AppData\Roaming\Netron\Preferences~RFe57abe0.TMP

        Filesize

        86B

        MD5

        d11dedf80b85d8d9be3fec6bb292f64b

        SHA1

        aab8783454819cd66ddf7871e887abdba138aef3

        SHA256

        8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

        SHA512

        6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

      • memory/4172-76-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-77-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-78-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-84-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-85-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-83-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-82-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-86-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-87-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB

      • memory/4172-88-0x000002A38E1F0000-0x000002A38E1F1000-memory.dmp

        Filesize

        4KB