Analysis
-
max time kernel
138s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
24-10-2024 17:44
General
-
Target
free_nitro_genV2.exe
-
Size
7.5MB
-
MD5
43bacf4266269569ba7994344e4db264
-
SHA1
4a678a57982a5c6fc975e90c2c5a1d98ae31b2a2
-
SHA256
1a29f95e79327a1dc31e9a7c7b2135904642a2ea4bb315fa6588ef7953b06bcc
-
SHA512
cbffe7b74e2466a673478b8050533993bc567232ee7d8398c9425015e8b7e221dea4a3d692dd3a0b76a5d0b87983aec3c7eab6056ace0e025a7ed7d7160dbf14
-
SSDEEP
196608:hs/AtVurErvI9pWjgaAnajMsK2TfQU//OoLxh:ltVurEUWjJjYAoujLxh
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 37 IoCs
-
Suspicious use of SendNotifyMessage 37 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\free_nitro_genV2.exe"C:\Users\Admin\AppData\Local\Temp\free_nitro_genV2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\free_nitro_genV2.exe"C:\Users\Admin\AppData\Local\Temp\free_nitro_genV2.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5001⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5fb8bedf8440eb432c9f3587b8114abc0
SHA1136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63
-
Filesize
755KB
MD5385dbbbd873a365aeb4a16d45aa731aa
SHA1ae9d89dad87e0a075df4871a8b062add1de7d09a
SHA256a182975ff182538d7dfd2bc422d070c15b60bab313fc0b5e4954447cc2a4287f
SHA51256e240e45bf3a4fa51e655fb27a0fd0294dc1d5f81d7dbd5c69ce1a57ef8437c0320ce321a903cc7888a119f34d4264063409afd16104187b3ab818a69ff9b56
-
Filesize
1.2MB
MD508b5763f9dc2057844b7e124a70d5268
SHA19aaef043ff73bdff4560694b0ec90d5ca341e203
SHA256fa2500966ed6bc1b814f58412e9cf49c9ea15930ef94cfa2df3f6f8309659ecd
SHA512af11c1900e23a96968c8cdb6f4aa911a365cd3b7a64ce2252b0dfa6298176c9274c3626636a76e80db7ac7271e4f94847e4c68c2335aed2a82094cdd26e8ecfc
-
Filesize
11KB
MD589403da85b6675ad65202acb26640ef7
SHA14494d2d2c0e277505878af16c07287c5b5873a88
SHA256f4c0d8943d48d855194e0e686d5d0b1bcc411a4b0742d05a29dca7be2de2fa37
SHA512815525e1e860a0e158c34a485d29424cd27cb3997d378967ed5d0555cadb7cfb0c740d13c5ef6ac8a8ba7585907acacc52f1ec1fbc44a153f06921aabe64ab95
-
Filesize
300KB
MD51b160f82bfdeeb4462392a6f1717dd15
SHA1fc67f2a8d97a77208f29c057bd95cdd8fdbe2d7f
SHA256257eb825357a837a4e9b456225a84f4be4ac02a1de12de9581fc17b82b83534b
SHA5123623da35dfb4ade31ec7321a14af21df781ecccc6138a71b73ac7bfefa175ac83fd12ef8eb82139db9e93d2588860e962e45167b64b681dd6a28ffb87f96725c
-
Filesize
652KB
MD56b2c2349533a66a0bf025cfed9a97ea5
SHA1ab7bc62c183a63ae0c982a62fa163ce03cc12863
SHA2568876b1e35d648c47a00c415e27ac9c3a986e80d360914c89d522146631183f08
SHA5120dba2a27a81c83e2e972c96283d748e1495f3397074897063c4518748d6e7daba811605c853db6be49f7a824e0097097ed62b2b6ad9c8192bd8429adc8d69288
-
Filesize
796KB
MD566c3076b8da5c028c77448f584dea591
SHA10d47684f2688fd28b00b5977903758dbd383395a
SHA25693075ce5153b58ee0abcd247f17ac33d0aefc1d3445da652c259a6a8f05b8b08
SHA51224ae5d70111c5fe2a9526a7c43f2adf7ba7976125072492c5b210229c4112c8d00d70976e681e6075ce3d201d9d31812c49b7b595dc175828e9b3a64d588b1e6
-
Filesize
548KB
MD56bb32b285f15458a0bb80da5038073b7
SHA17ca7ee569a5a33b7200edd41dfc7c235f888ae24
SHA256cc8529e59a55883ac6df5e09753ed2675a575883f02667bac96dff7a9a781213
SHA512a48ce1050cd976f6fea72b52383b3413d6b0fd43bbdc0d49e8ce8e95ad5530d33fa63e020458f6839fbe59dc77bfecb2d48cb494a815ac5d576026059b19b9c7
-
Filesize
341KB
MD5409aec216e752f30a16abf31e837611e
SHA102ab01ff35602a000b5bffc5a7ea8b401a4663bb
SHA2567688708790fa961297ad31832d7d5472eaaf51ceadc8f5ea995d47a80cc3fe06
SHA51253a1ec66fee0b0882629338caf3f57c569b36f063ee444786b5270e8cb4659797297ba817badb1e996e7ba1d3d4a866d68f1c60e19208677b8aa542b68628822
-
Filesize
672KB
MD54fed735a1b895306da8a897eba2124f7
SHA1c7e4631010510894c16f2f80154da7df51bee79f
SHA256047c91d173c327e331e9adb2f2c6f9a739b8feb0e5a7729cf551816c041cccd9
SHA5129773878b87f4e22bcea059dba781d401dc18203a1e73ec6d313c7eba084714d47b4cf7292b6b7471d875ca85b530cc63c344b85f668c9f898a50bc8b95fd1fcc
-
Filesize
589KB
MD5456b11716c68526c26ca71e0416f296a
SHA1ce609e49053c976a320a60425505784f926126c7
SHA256b2edf8b30f9df786e43f66bf5bf37661a7fe651aedef296a36c08de08f258d24
SHA512ea9be13c626d76ac30fa4ac9d119b86469690166484875e0b9be631ae32518c2d52e2dd03f5592df6d46dc654a36b9a1b8526e1e0b5b895ad46cf73c0df48dde
-
Filesize
486KB
MD56ed228462ea1a937a6342eb3abf8d00a
SHA1988517937db04ded3c957cb69c8d8587e90d447c
SHA2567bdac14d4d52eece7dcb0226bf00a2c7dda21be08b171925de7c182ccd48e779
SHA51211109aaed55030edb2d4c1be5e7a139ebaa15d1c26ea4fea7d8b278918a728797f38b27bda43e20bfc5582e7ca0c585b6d5db43e4e0b0e0d1b276f483538a82f
-
Filesize
16KB
MD5a442c19ed54dd97e40ae35d3356dc0e3
SHA1903540fdf08dab6dc6e1c8dc7ff4c43804e9af8e
SHA256b06eaaa92a4923986334f1a0f396a4681b759a06341134d9fceb9583e05b0510
SHA5124c3e7037787825b050f53ecb62e8c9341e7970807873617a77f70d105a56e6bc70eced6e7dd9cf13ad0f820557dd290518909cba23550294d88dd7b0142f2fcd
-
Filesize
776KB
MD5b1847f76c9ac0ba57f72f73a0d17842e
SHA174086416bd51ab5d5c3a15acad41ac5c9eb3df70
SHA256f06a59b88fc6d7e2bfc8fe0166b075d2a14a10028a0d4cf1d7282e51d84b7144
SHA512e4e45b727a55dc89991aea5543388195bc77bb95fafcdb81ca0eb26c4ff266ca028c9505c9c19b311b40e9085d07c80ad26eae3e94a765dabef31852218af88a
-
Filesize
424KB
MD582640401c3977c5c63e8172e747a75c1
SHA1850c1c74f518cad68cb2803e2929630e6e2cfb45
SHA256cca69c07da5534ca410eff79d45ab124ebfee84bf47f7150c108452ed8df8355
SHA5128938f7f72726ac8f876335e128c234e7ebde3a58bfa28b8b9baeb009d5536f7d9c6022dc8f963db1ff24c7ff7ecb044cc78fb0274eb62097e977b2e14fc31daa
-
Filesize
465KB
MD5b691be583babdee78286a754143d32e1
SHA15578a7d7c13a07216e7b0574a831d6686c5f3120
SHA25629b729ec8d2ca62a8c0bd23de726f9ac6be0d5ce2eeff7c4d56b55883fd44ae6
SHA51227cf49ad9325bc945ef5651009f44e4448361875fc4bdb38a12929f7d098d67cb9cdefe3909cd609ca80e892d9e4fdb81d684cf9f55853bfad638a01536e11a6
-
Filesize
382KB
MD5cd067ce26eb5a8a48b434d1e3bc349c6
SHA13c062d0ee1851b7dd8f0e9614e16115021ad2160
SHA256ed8ec882dd170fe44bfe4599256ad10e5f560a82884cb2d96e653e1793bd3c8d
SHA512632c69090164c657e02aa0e54fbe41f55bc30cd3fc1cb91948b1d2be0953a6641e208205838469eb47e41d1fc7104a7057c9691578f7779d351d2ecc0c890639
-
Filesize
569KB
MD567e19184a8662257c177966392305fa7
SHA17bf66a0cb0a58d240e79a06ab6fcfce3518d46bf
SHA256b92652320181d967d8dd2f9a26d6991280e16f3bff7ff7c0df2fa06c75bff23c
SHA51224e9f3c0bba1ed4e83a6273ee42962ee9f8cc29e1f42a8c1ee5bafd46d266fc8ba67afad001446f69b16efc2ef42e6b63f7773927bb585d5cda48c95a55a58a7
-
Filesize
631KB
MD5cbc836e7b2ac4a8b5394f0fec1a29fdd
SHA1d8b800c410ed9e021a00c90fd1ee65f443f70edc
SHA256c96464060a3e6deccec2ae04c61e242f20fab2f940d1e5cf7d645a5c7de431d6
SHA512dbe14f891f94a5e470664d6886376b24986ad74c46b38183d7dfc9e53c063ee5e34cbed3e415067ec1de0db277109463e0c99f878cc3d14bf987580fba854b1a
-
Filesize
734KB
MD5a2e18977dda26b4f735f090f284e856a
SHA182239af4914e33003bbacc78ea5657a24dd60ed2
SHA2566ba0dbc81fe9aeeb5ca0a877682a7b6a9870cc9641359da0d0b47bfb5b96900e
SHA512ab8aa6ded0bc8163c8ef7275115ee2d94962087cec2f62973f85e71dc8b76bac128a46c9e3076e831c0707bf94faebad4a76d7e147d5304342815ded3e167afe
-
Filesize
610KB
MD5e946915db8d8c613373b722ae63da2ed
SHA1e96c81047d917873c7843d6a5a209115341f8114
SHA2566e7b1e3765a4934931994e357d7de92c07f9027c52bf71a23ff329f42e717fd2
SHA51235fd8e928af1d1ae5e82c82b0e9fad3fa6b50c0811c904958bb26bc1e55c4fbac6820eb93bbc4e90ab2b90adcac0fbc1f4f047140e75226a281eec3411b31486
-
Filesize
859KB
MD528832d64e64ea4a57a7326e3998e7dbe
SHA158694cfc6b2d2fe9c4dc2030d1dc6bf3a8e81174
SHA256933d34677adfc7409caaace3f74ad16c2ceb11231d18837fe4988ab606a4c4d1
SHA512db818956471ee2f3ae45558ae8f673f842887c9fce25c9cc6e674a3745d67a1f796a74d136092e16dd402e96e450d839d4fad68d7909f49b95c871dff41af2fd
-
Filesize
693KB
MD53fa4ad9c5db405e5e0bf42f218f6cf3d
SHA140f3929ec716af8b5bda5039fe8370ae4ff79914
SHA25613793d59fc60433ce32247825e62ee83f68d4c86c3ad0108376e104d1cf97d78
SHA5121f9163c44eff38abec19411ca9eec512087e6427baf682849761912fcdc787c10bd5571a31b7c18390d35e2e85c7b178df529d928c83eb4d083e489f5eb2202e
-
Filesize
362KB
MD5b42f7807f0eadd854cb38223654f7638
SHA14ccc697a84ddf46a2b01663d68dc2aa2e609bc90
SHA2565611f675a6d41f3f86c2fb0c7464bf29ac08b9359e0701fdaa25444822aff155
SHA512f8ba0dbcc2f06678be25cbd479066ec1058285de2dd3c418a2e1f001d408c7e709bb32cd4fe70509603e63808d3293923bf09a244f6c98a3cdb7c52a3e15f558
-
Filesize
445KB
MD58832a1a6f32cf0ecfd447c71f726b625
SHA116e14403398f8b1ad14e913c4d962989e2aaf603
SHA256ab00679a3f0da3b87322443c4ae5b15374d79ffd4008631e9f5aadd3e228e5e9
SHA5120697256b57b057efdedacd214feb0e928f03627ae6287496995c69b1645322672edabac7ec52b73b4f69e9720ebdf9437498062fbb00b25363a4313ff294cab7
-
Filesize
403KB
MD5e44ee0f53864014fe74a2855d14d8a6c
SHA130717269c79536b977436d5aa7356547277ebbcb
SHA256a1e11ee95f284b58fb5182c1edb6e1fb2291c6a49d93dee8dc37d511ca179d72
SHA512a3d27732d4dc5a0fab41a7877d52d9a7cf103fc6dc016519562c01fcae46468107c0ef7e851bc37322a49e377cfd73880ace767df5afa9931f6987de8c0d8cbe
-
Filesize
16KB
MD50b297c77ab7ac39d631d5d7e81323094
SHA132774c478040d8c58bc5ee196ac5b045779409b5
SHA2563a60ea47aac9c5bd1b82a2de7c77d7ee29f33dca00aa2f1dc8c5a0c2bb860eab
SHA5126d959c313aabe8397e829a92ecfb6bc86e45fbd66535b15896762f268c702c858dc8c4081463e5c05f0d9fb47532318585f123765b98bfb9a665f40c0190f1dd
-
Filesize
14KB
MD53ded52b808e279ed719852b19b179465
SHA1c13c3f1ad41f8d4ee7fc9aecad580795ee935443
SHA25617120fb3a92ad220df8800d4e51d03abee53f3961dfe81bc8fc36351961f5403
SHA5124a461f2b488d2cdbf33830171dc7736ba2e4bed91d43ed45b88e2143c19a8787723837001b9e9804c20f332e9e1f77e1a746cd85739bf3ff683a6c2966949e75
-
Filesize
838KB
MD5f8be912c535e5870ced1a02edd6d9059
SHA1f5232d3b7500073e407251f6d92d185ce9d8a03a
SHA256062e9da9c5aa9118633b9139eb4c95458f2bbff2ede6a214c59f2221295d612b
SHA512be7864cd4810a8e814f5582c86aa5caddaf781e6e0364592ae3052fda4a55645091494e3d01b98f7e18d57faf70101977b863f69197a5463f72215f683dc62e6
-
Filesize
19KB
MD5bf8f8463c1494475249b24e214ab1f19
SHA1e95798dbd5f44fc4fe340c648194c8dce73d2eee
SHA256ec0704ce0686e0e4a67fe281b59ca9efeb7bb6a20912f7e0827f4e2ae6b80a8a
SHA51211ed94f38246e1086ad6338b0e1baa9d5609263efb111ffe7373525050778aae5ddedd476badb532d37b921853dfdf6b02b97c54baedf7530fbc2851ada30f4d
-
Filesize
320KB
MD59196f386454db951bdff912324186f4e
SHA13206b876d66add25801382a2226555ab4511e8b3
SHA2561fd7779f54378505c028cf6bc92acd6e9b2069875d354a8446a24e25a3573cc1
SHA5123137b0fa4fe5a9505799eb4e38bbd726838e7ab65138c3da91d1f3d421ce0e7ceff8d830043b6ea0935e8d221ef4ee12b8d7e105e56edee75d374522e230bb1a
-
Filesize
714KB
MD530d74bf9de58eef43e46a61562909a57
SHA1c14c3c86a07cf5cbd409127a66f01fe3fdc4316d
SHA25627df6c85313a67b51db1944e397357b8d5229afe5e1a29e62a50b2b4f9f250a4
SHA5128eff58e838f60c347c8bee43d9bf9711e745a8b93fa393fac496322642ba0037882ecc5946a9d6c9c895b1a8bfdba682288eb66661f437527d592a7c02531b10
-
Filesize
527KB
MD500103ce5743ac75e38f8317f3f762a30
SHA103757eda0b5139bae7c5ce6c4706be6169d01231
SHA2567f9642751296f992a6cd597e224d79e9aba2ef0c11c66dc45883ef7cae5626b7
SHA51255f5e72e2b65c88209f66e38208e304156e796cf5a1e5743c484ab411a0db2aba8b7ade4c6eec6d2d017a48a702996bac3a68b8223f0b1277e94ab57120c6d18
-
Filesize
817KB
MD5e9a9e3940ec1bbf324f91486a7b0f85c
SHA1b5136a175ea1c44f7f6f8ed37f9de9e6bf4ebe55
SHA256658b643dc0bbb6829b406dd5a68f9ba1625360541b51a0ece9f084ea844f6f19
SHA512189284b10f5af6cb5337ff649c8fa7cdd3e1cd4eb1bc38333228194d731408cabcb20f9b41e16722491f263f13e916c019a75dd8ba21748e2886010b5f227176
-
Filesize
507KB
MD57a354cb91b52fbd871ee4db0b0e5de2f
SHA11ec2e77f999b2d28adf75aa66d5c9cd231fb1093
SHA25643502b73b5df3fbd7105e51608293231da31f0f39a8195373b039521ccffaf6f
SHA512576debc923c4eb42b17e7a02e03890d4922269955fd42486077e5e17dc901608f4e024889c4f66f0c9e52a3117ec4290b18ee2d7154b9ed283f99a75de36656d
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
232KB
-
Filesize
6.8MB