Overview
overview
10Static
static
10Bird.exe
windows7-x64
10Bird.exe
windows10-2004-x64
10Crystal.exe
windows7-x64
10Crystal.exe
windows10-2004-x64
10Install.exe
windows7-x64
10Install.exe
windows10-2004-x64
10Minecraft_v4.4.exe
windows7-x64
10Minecraft_v4.4.exe
windows10-2004-x64
10NewHacks.exe
windows7-x64
10NewHacks.exe
windows10-2004-x64
10Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Software p....5.exe
windows7-x64
9Software p....5.exe
windows10-2004-x64
9file3.exe
windows7-x64
8file3.exe
windows10-2004-x64
8forcenitro2.4.1.exe
windows7-x64
7forcenitro2.4.1.exe
windows10-2004-x64
7nitro_gen.exe
windows7-x64
10nitro_gen.exe
windows10-2004-x64
10Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 04:18
Behavioral task
behavioral1
Sample
Bird.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bird.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Crystal.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Crystal.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Install.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Install.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Minecraft_v4.4.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Minecraft_v4.4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
NewHacks.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
NewHacks.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Setup.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Software patch v2.0.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Software patch v2.0.5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
file3.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
file3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
forcenitro2.4.1.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
forcenitro2.4.1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
nitro_gen.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
nitro_gen.exe
Resource
win10v2004-20241007-en
General
-
Target
forcenitro2.4.1.exe
-
Size
78.9MB
-
MD5
d292c1fe9f36882b01bd70a2b0aa391c
-
SHA1
72b0aa6d32e09ced66a3c10414e02e84569e009e
-
SHA256
a5c3478916ed2c028f824b22b73fc10699be8640b308e5986b7490a1ac818da3
-
SHA512
138acc03b072806327f03ab6149d2ca86e53ceee33420362047a2e86c800d6c7aaa21401c0a8c2eae627e42f17b2afb6a58e0a6a9eddffa2b330a85bf31a91e6
-
SSDEEP
1572864:vBrTvQJaVQ3L6y14qMZJQsl6R7EYvrFn97PSAGJAVP5ieBmhxU:5rTvQJiQD14q4cRB7RVBFoxU
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1224 forcenitro2.4.1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1472 wrote to memory of 1224 1472 forcenitro2.4.1.exe 32 PID 1472 wrote to memory of 1224 1472 forcenitro2.4.1.exe 32 PID 1472 wrote to memory of 1224 1472 forcenitro2.4.1.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\forcenitro2.4.1.exe"C:\Users\Admin\AppData\Local\Temp\forcenitro2.4.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\forcenitro2.4.1.exe"C:\Users\Admin\AppData\Local\Temp\forcenitro2.4.1.exe"2⤵
- Loads dropped DLL
PID:1224
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5c4b75218b11808db4a04255574b2eb33
SHA1f4a3497fb6972037fb271cfdc5b404a4b28ccf07
SHA25653f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2
SHA5120b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c