Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-10-2024 03:25
Behavioral task
behavioral1
Sample
nuke bot .exe
Resource
win10-20240404-en
General
-
Target
nuke bot .exe
-
Size
9.8MB
-
MD5
cf88f81270f9a6abb71bdfacb7c5fc96
-
SHA1
6a99eb6f3b0b266136f86f81070afe8df4622615
-
SHA256
ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a
-
SHA512
6657b2eab3d2af4985d46ca7fc78c92d1cc9a3913b2bbb0182dcd13702e9e58abac7273727afca031bb826f8e9e99c2e881ff7cfe1b0bdd2b9e7b68a04ee9785
-
SSDEEP
196608:O2RuMeNj9iBqRsj41YWuJ8IcUeOYXOxfOsYk6dnvz16:0TUaYBJ8IcVO/xqdY
Malware Config
Signatures
-
Loads dropped DLL 30 IoCs
pid Process 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe 5000 nuke bot .exe -
resource yara_rule behavioral1/files/0x000700000001ac1d-36.dat upx behavioral1/memory/5000-40-0x00007FFB06B70000-0x00007FFB07159000-memory.dmp upx behavioral1/files/0x000700000001ac03-42.dat upx behavioral1/memory/5000-45-0x00007FFB1A950000-0x00007FFB1A974000-memory.dmp upx behavioral1/files/0x000700000001ac18-44.dat upx behavioral1/memory/5000-48-0x00007FFB1AA80000-0x00007FFB1AA8F000-memory.dmp upx behavioral1/files/0x000700000001ac02-47.dat upx behavioral1/memory/5000-51-0x00007FFB1A930000-0x00007FFB1A949000-memory.dmp upx behavioral1/files/0x000700000001ac06-50.dat upx behavioral1/memory/5000-53-0x00007FFB1A840000-0x00007FFB1A86D000-memory.dmp upx behavioral1/files/0x000700000001ac0a-54.dat upx behavioral1/memory/5000-57-0x00007FFB1A820000-0x00007FFB1A839000-memory.dmp upx behavioral1/files/0x000700000001ac1e-56.dat upx behavioral1/memory/5000-59-0x00007FFB1AA70000-0x00007FFB1AA7D000-memory.dmp upx behavioral1/files/0x000700000001ac1c-60.dat upx behavioral1/memory/5000-62-0x00007FFB1A7E0000-0x00007FFB1A815000-memory.dmp upx behavioral1/files/0x000700000001ac09-63.dat upx behavioral1/memory/5000-65-0x00007FFB1A9A0000-0x00007FFB1A9AD000-memory.dmp upx behavioral1/files/0x000700000001ac0b-66.dat upx behavioral1/files/0x000700000001ac17-68.dat upx behavioral1/files/0x000700000001ac19-69.dat upx behavioral1/memory/5000-70-0x00007FFB1A7B0000-0x00007FFB1A7DE000-memory.dmp upx behavioral1/memory/5000-78-0x00007FFB1A6F0000-0x00007FFB1A7A8000-memory.dmp upx behavioral1/files/0x000800000001ac00-76.dat upx behavioral1/memory/5000-77-0x00007FFB06B70000-0x00007FFB07159000-memory.dmp upx behavioral1/memory/5000-81-0x00007FFB1A950000-0x00007FFB1A974000-memory.dmp upx behavioral1/files/0x000700000001ac08-80.dat upx behavioral1/files/0x000700000001ac05-89.dat upx behavioral1/memory/5000-91-0x00007FFB1A840000-0x00007FFB1A86D000-memory.dmp upx behavioral1/files/0x000700000001ac21-92.dat upx behavioral1/files/0x000700000001ac23-93.dat upx behavioral1/files/0x000700000001ac0e-95.dat upx behavioral1/files/0x000700000001ac10-98.dat upx behavioral1/files/0x000700000001ac11-101.dat upx behavioral1/files/0x000700000001ac0c-104.dat upx behavioral1/files/0x000700000001ac14-107.dat upx behavioral1/files/0x000700000001ac16-109.dat upx behavioral1/memory/5000-122-0x00007FFB1A630000-0x00007FFB1A642000-memory.dmp upx behavioral1/memory/5000-121-0x00007FFB158D0000-0x00007FFB159EC000-memory.dmp upx behavioral1/memory/5000-120-0x00007FFB1A820000-0x00007FFB1A839000-memory.dmp upx behavioral1/memory/5000-119-0x00007FFB15AC0000-0x00007FFB15AD6000-memory.dmp upx behavioral1/memory/5000-118-0x00007FFB15AE0000-0x00007FFB15B04000-memory.dmp upx behavioral1/memory/5000-117-0x00007FFB15B10000-0x00007FFB15B1B000-memory.dmp upx behavioral1/memory/5000-116-0x00007FFB15B20000-0x00007FFB15B2A000-memory.dmp upx behavioral1/memory/5000-115-0x00007FFB1A620000-0x00007FFB1A62E000-memory.dmp upx behavioral1/memory/5000-114-0x00007FFB15E70000-0x00007FFB15EAE000-memory.dmp upx behavioral1/memory/5000-113-0x00007FFB15EB0000-0x00007FFB15EC5000-memory.dmp upx behavioral1/memory/5000-112-0x00007FFB1A650000-0x00007FFB1A66B000-memory.dmp upx behavioral1/memory/5000-111-0x00007FFB1A670000-0x00007FFB1A684000-memory.dmp upx behavioral1/files/0x000700000001ac13-106.dat upx behavioral1/files/0x000700000001ac0f-100.dat upx behavioral1/memory/5000-88-0x00007FFB1A690000-0x00007FFB1A6A4000-memory.dmp upx behavioral1/files/0x000700000001ac1b-86.dat upx behavioral1/memory/5000-85-0x00007FFB1A6B0000-0x00007FFB1A6C2000-memory.dmp upx behavioral1/memory/5000-82-0x00007FFB1A6D0000-0x00007FFB1A6E5000-memory.dmp upx behavioral1/memory/5000-75-0x00007FFB067F0000-0x00007FFB06B65000-memory.dmp upx behavioral1/files/0x000700000001ac04-123.dat upx behavioral1/memory/5000-125-0x00007FFB15880000-0x00007FFB158C3000-memory.dmp upx behavioral1/files/0x000700000001ac20-126.dat upx behavioral1/memory/5000-128-0x00007FFB15AA0000-0x00007FFB15AB2000-memory.dmp upx behavioral1/memory/5000-129-0x00007FFB1A7B0000-0x00007FFB1A7DE000-memory.dmp upx behavioral1/memory/5000-131-0x00007FFB067F0000-0x00007FFB06B65000-memory.dmp upx behavioral1/memory/5000-132-0x00007FFB1A6D0000-0x00007FFB1A6E5000-memory.dmp upx behavioral1/memory/5000-133-0x00007FFB1A650000-0x00007FFB1A66B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 5000 1928 nuke bot .exe 76 PID 1928 wrote to memory of 5000 1928 nuke bot .exe 76 PID 5000 wrote to memory of 436 5000 nuke bot .exe 77 PID 5000 wrote to memory of 436 5000 nuke bot .exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\nuke bot .exe"C:\Users\Admin\AppData\Local\Temp\nuke bot .exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\nuke bot .exe"C:\Users\Admin\AppData\Local\Temp\nuke bot .exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:436
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5cb95a91c8b907752b69c8f12a72bc40e
SHA11e9504a7bdc0e9abb8bb6e39da2ba4e0d7386efe
SHA2567d87702964e1e1faca0e30325900c3f075fe7acd05b3692f9f5e062b60e641cc
SHA512650d1d626df473858eac810dc2f8697e18d91a5a6d2a17f8643f89a6215e43018852b81b82123cce80ba21d1249258b3eee944fb4e9571f28e1fce6a6d7b9bc6
-
Filesize
46KB
MD5dafa6d12daef616d7afb2853d339b4d6
SHA1482ec0e8581ad99c42495fb76f42884191481399
SHA2563260d2120df53e7a4a3d68299e72d8919fbb956f30d92d2d0f75f055bd72262c
SHA5129358cb9a0b728567d5800efbb139f0fd6c4b016f2c6ef366d770f8f0aca92eb42d5769f48f4ea11e6bf064a04fdb3901f86db80b3f622d0ea8b8ccb1cf2c26f0
-
Filesize
56KB
MD5ee797ca2e9dae16f1afaf5350c0fe170
SHA1623a9ccbff3a0c9416e882e0ae4251caead84aa5
SHA2563496264fa3f5cc6cc5c7f359bfb1f3a2388065f45461479cbcc6ab88601065dc
SHA512dbb6abc1d738c783627db7ef9e553bfffe7af345f2bf0dadaa987d4ca6c883ce55ac9038da95995c68d1691f296f20283918119d803ad1f930f04fe8bd067018
-
Filesize
104KB
MD5e313e859ded9d57a93d5c9458841cf8a
SHA1d45c4ffce746691e1eb35ab6e2432a6c7095bb14
SHA256bd700d7b50849dcca44ad1df5f8ca8176fd287ba43614bc1c58a80a07a05f1e9
SHA512227560009c898ca7ab2c0da3885fdfa46fec7554eea2a914500a3e6baa83c8861ab4585000230b80259e2c60967eacf842a13ff369ac3e6359ff2df56796fcbc
-
Filesize
84KB
MD5d79bdfeb08765cedcb612cacf40cb667
SHA19008847fb90a7bcb84d6ebbb34611022a8118cb8
SHA2567909a4571b1af1f5aba469f6c2a642c1fbdc949890c96a89f4782a53a7fb5471
SHA512d53d11e75ef590e8578af5cb8be71fe77930f9cfded89c1afa0bb1d04410432cd655d4d4287c0c7c547d9c667dba7d2bd51ecfda727fb312bc2c38993c1360be
-
Filesize
30KB
MD57f766374428a6d7390724f659239ce69
SHA1c69be06cb7d8257f42d03815164323a746c525fa
SHA25640588139ae6eba475e5ab00d90eed826aa374b7d335298d106dc81153142e19d
SHA5124515f80e09281ae5bd619fb881e6a4683ac854c2c85f5d010aa2cd3600a08ccb80bdae48320c8582deafe41b0a7d0996a88bce38a66c97721c0772519d22b933
-
Filesize
24KB
MD58b91d1de78b7e337ad267cfeb5c22b15
SHA1f1f7d67859ad0007f1a4968a82ac0281829fa61c
SHA256981a27eff5e45b819c295cd669c905bec18faf661fb5183f255932b627d008d5
SHA512c52ea0bef75b33c912f089654af75aa684fb8337d452e326a2a0a764380c35219c1b8b8c979694bff1eb0b32aaf1dde98de4ec51b88e332545ff703e89ea0366
-
Filesize
41KB
MD598b4b4b16b28cea6bc7ad21e5b7099cb
SHA13d68d473e621ae6f4ea8d45f009d76fd31754a97
SHA256604c46e40e85ee8cfde8b6092d4785bb4c6b1c3692e648ce30fbabc119527014
SHA512e587ef54944d77189666c2f3ef9a4e27ebc17fa53ba12fbab6246815435bd63e7df4634b34f44b9e112f89f4cd56caaf1af066e14102d8c7fccf0355d2cc454c
-
Filesize
60KB
MD5cd4cd236dfd476e629c5e30597d0b5d6
SHA149df5575ecf1f58f3f61daa979518f43d6fde86a
SHA2560713d93a6c083f2ab1391dc78ad5d897c1ef4eef8a71648213d6631f0b6843e5
SHA512829b72f81cfe3563ada7ea71d815b1a4772469a3624dff600ea1a532b3aac554a4f3a64950087f6d05b67bebe937244ff75a9eeaf03b3f80fd883e7d52f859fe
-
Filesize
20KB
MD51f08cad759839d57af8ad8d3d66307f9
SHA13407c49d52c46778349d5583b08bcd55238b882b
SHA256926eda0ad4312561f65a0ac786f40de0e7edfb78467bbd3f2f647211bf3b895d
SHA512c2e82e7d40e92c2d5cf5a8181c63a20f31c4e7134fe3bce581de4969d8a00ffb3290d5a7eff99c262c5b8d7a9813ede275a784dbc0c1e9d34ec8a2aa24e9de74
-
Filesize
14KB
MD56e18d60399ab6e284f11dfae829bb8e6
SHA1b39dc183f9f002dcdc0a6ca07dcee64286cce764
SHA256edfadfab5ad2428365f9e0d6cd9e91fc4c29b78b9e3e6ac7cbcd118ed986f11f
SHA512452def3915a095e5410cbb0f4b6e7e1a885ee9217f4f84bd6bf63e8201602c03ea382270291dcf650a2132029e24bb11cd29278411c5d4ec904dfd306c8f59b8
-
Filesize
1.7MB
MD5e9c28bc7ae0276a2413d913fabe101cc
SHA1baefb0b00eac192113737106bc76b02244c17838
SHA2567ecd1dfe0dcc82c2e595729cb238acb890326adc87136334ce9c21a5f0c847bf
SHA512c25532849462e0dc1e3e7fd5f0dcc93a5dc18c7b29920819143ec30fec899f98cb8a538ab0084b9ba91f62705de3dededef6acfae02daf1efceabac3819804e9
-
Filesize
38KB
MD5c85002eed76b760e311b042f5831a4a6
SHA1a5ea6c4e3dfc6ae735f7ff9876839940507230fd
SHA256d2dba1513d01ca0a06024bbe7af43a6896c327d370153407d430ba8b5abea55e
SHA5120f7e1b4b80975945e9aabdb559c7a2a0ac43128d979f01d11d04092b93148ae2c1fab88b4ed5cf004305fb4d7dccad32d5bdcdf75cfd554d7329a2773c29d9e4
-
Filesize
24KB
MD52ff22166c3bdc9dcb9ea6de5e8d16bbe
SHA1d0dd16250d01150e93b0ff645cf2acc51ca5ca31
SHA256776214669dfab09c476e9a26be0e67bf8bb2df9e7b7bf2746e6b3d2a54b09d0f
SHA512c5ec6ac73e83c3e7879bfd90e662cf537784d37dc15c72fa6ab28331c756ccde5185c72dab4b1e56e1b4a2bedc4ff99233f194fbe32492c03eda3f8df7efb3d2
-
Filesize
1.1MB
MD58a0b20d8e0e7f225693d711d556adc8a
SHA19486b7bdba3682f29f918ec22ec3d3f0dd0101fd
SHA2560b7ba07933749e08f265ce5f9361a52cd00c86c84713db8c7b6955e75fb8359b
SHA512164b5138e708c494094c60084945b24c73ff345433c8231fcc79a8fa5059634374f8998b04d9a967e37cde8af88bd4ff4484eca641fe112952af4b98081d7bda
-
Filesize
27KB
MD5aaf07947fe7aa9980900dfd10145c32f
SHA179b605e95c55524ef13ed130fddb277df121aaee
SHA25655210e5a2e9885c30624cda41bf4a83b2598e661590349e7997ab28be70569a4
SHA512e17463ecdad0c5fda59197b0bfd2f35ae0580e8791eaad5ef52c2ad876e993709fbe7b6c10e5a16eba276c7f8163f5acffd86fe500652854407ae036b8befabe
-
Filesize
203KB
MD55fba49b16f11befe297103bc28f20940
SHA1412a4d12b6837314826b3ab8f868182da12b1f1a
SHA256cc147f1b1467d4646450b66a8e59d26980a50f36fd3176eb2701e7bd28b22c72
SHA51262881a3b70afea335819ca2fafe85711607ce526f45a628fa775574c36ff3b287d5c9b9a8449131831e15644048a5e8255c3cae91487bd8cdd90e684748dec98
-
Filesize
86KB
MD5a9ee1c53c76d3c2c622a5c4649edcbf2
SHA1c9b0e3269d9eb5e6aa47c39619f70b3e8b208924
SHA256446f5b0e6fb174ba8f2c8ffb45d093e87f12b02b1119e9b4baa9642c981321ce
SHA512e256b074dbf40a662398f0b2eb909a498051e16eb7fedcdd5afe247f80632a60a8cb01cc5aeec52f1d392c90b5aaaa94ca4b72ed2d3e0d4018a840d7408b2fef
-
Filesize
1.6MB
MD55ef44effa518fc9b3acda79684381d75
SHA1df6d1a46e691dce3373800b188137eed4ce97dfc
SHA25690fe310cce48c73f05b7e678a36f2d6bb8870c316b9f12495255b60ad7787777
SHA512ca52ccd9dedfb03d38544cb2f5a248d52873f7ef143ee3693d2fe11e941e81c5a48da277dbe0cdcf5b01701778ba083d0355fdfef0c13faa59411e7e12e5928c
-
Filesize
24KB
MD5ccdb37c527ce2db915e3701ee204c7dd
SHA18454bc2761504ea11fbaa6f2683bbca36a3989a9
SHA2560f8d10473924f0bee9430be8824f8bd626fa4efaf98cdc10eee64e70dd4ef3f0
SHA5123e04fecf39585445f2541d5ee16c3e522770daa9b1778a5e51db68261d4080e1b5373ded5a9a46f5f2204de1049be85814f86b28dd882ced8cff0632c34b70d7
-
Filesize
19KB
MD57537313d97bdcf7cac86f9e9a00527cd
SHA1f4afaafc207e06222b9c828cd15b4fd75e620d0d
SHA256c8bda770244b2966588758752f19c735efc71e3a86d077555040d3ff0f47ada7
SHA5121dbb67202d248a825188a52ec0cf7bbd05ac8d687c0976836b518c89ae23fc722ce98dfacc08def9c27f066643860dcde9935a104c5ddaa11b19afb4c68f5dd5
-
Filesize
30KB
MD5a364a3210e1b7c35f9bb9c1672ad5fc1
SHA1d1c65204c9ef8d601eb2800fb96925cb85cbf274
SHA2568ec8b9b6f9cab2aaf787d29e16f1e6a19fe3a88ab1948c4e25922f20f3e22f09
SHA512b7f96701f284abda7dcd8a6d25cb34a9314c04a401799863672199e84ba72ee207bf92b80ad7135379fde4cd8da078b982a446c11e14d086ed6eb49cbde8d862
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
33KB
MD59b98ab14cc78ead3b6e25deaa45b66db
SHA1a49b4621a592fd1fe09bf9638917407c7df4450e
SHA25671c588c4d87a06acb3275537783ff34950e6dd651365545fac42c53ed5fba182
SHA5122fce844285e7f1a8cca88e80b132da736ffa3efb50a498daf687546ea410148693ef5d31d9da2a68784bcfd3e15e34d13c3868a90a814ecfabe006d911769cfc
-
Filesize
21KB
MD5adfcda65b24dba25a281160c8e2549b6
SHA1052d2b22afb1442025b5ff22501e18cccc017d04
SHA256cfda1ec3a28982545816b037799c0d1c089ad82d0a255efc97b23ff60571373c
SHA51276f45fb36e614fd96498bbb6a3de00730d12f4bf7f89a63f3f9d75a66c8598ab105d1acbb53227437b9a89b8fd81e6d6fbb059e62247bbed01815a4c0f6a52c5
-
Filesize
63KB
MD52b1aa1aecbe9c124ff07fd349c9b3c8f
SHA1cbe2a15c9e09ef0d9ef8ff61305deb14b0d937f1
SHA256402d8443e33b0223e28f6b9c3660073ed1f35527a921b455ada1398ff299a03c
SHA51270b206cbef196ef0555ec27edcd61a3a7a2278afa284aeefdb15dc7d583cbb4486bfc445c809dab0feec82756db5148deba2d18a35a4272bbd694643eebb0b8a
-
Filesize
19KB
MD51a75e171dbeeb2fb92ec885e2bc5652d
SHA137b31aa6ec621dafdba16f044c0f8349959168f2
SHA256d2057b4cfa5a1687601fcba4b2730d76b90da4db09a1d76b1943a4751961685a
SHA51255850a84cc065b36e7b5374ba840abf110f8a2f5fc3a9840e6a1163087e85a0cd2538ca1e6d42bae2fbd89513aced846dbb00bcfabd1dff4ee7a2f03728c05c2
-
Filesize
9KB
MD57f1584f25ffd99d876f6816db20d033e
SHA11b0e9d7d2e2779887299f29ad991dc5cda7eaa5e
SHA256ff381242e40a70510e0e69a34e3ab18fdcdb56865f5905425d20ddfff3452400
SHA5125f6a01985b820aeacdd5e54eade039d20e90643510fdf2a97be6b955436420bb38a86c44f6245aef0200fe4515800eaf231721ecfe50dfdbf57b96a966d828ed
-
Filesize
20KB
MD5926e67372520a3bb5afaf00ecc0a2baa
SHA17cd4cddde1a7c6b12168551ce88fbc8e6a9486e1
SHA2565c120e3ffa9c3ed47455d3e2ea63da488ec77937236c9e91f1213810f9ca1146
SHA512bc64b93d144b56560f145dccad1849e8e8b982126df074546f08a0276ee33b7d5cf53241eca80223ef7f989f1b10cbdd7e0a5690f9b3d0de433cf1ca7af79195
-
Filesize
294KB
MD554386c35a62c1a9eb63a29863f623a63
SHA17bb961b23816d30b727448c20bb65a57f64c95a1
SHA2568066be8a9e752be80afff19fb21449998964dc8882cbe947230629ab21dc1009
SHA512f7294832edc2e0bf87359bee12d60aac6eb397bcdd848317c0444a22b855f986d7c550a0268bf47902d78e9f0aecd206ee487e2081dee6665158f0ceb327e5e6