Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 15:35
Static task
static1
Behavioral task
behavioral1
Sample
676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe
Resource
win10v2004-20241007-en
General
-
Target
676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe
-
Size
89KB
-
MD5
e521d58d6d0626ad3b2e2c9dd1a6fb70
-
SHA1
b295cc3b2aec3493689590a5e002a2858058cb12
-
SHA256
676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89
-
SHA512
747140a30f31dcb1f3b2856f0e03a3f14b87bfd030169061e2c862312bcd5aeb5c50f2505ebd1e67f51f2da6d3512bc2ef0fc2a6a02ae7b1dd651dddcba59251
-
SSDEEP
1536:NkYT9ikLoSh6AX6ZM27qWluAI9ph2jlbRs4Cl9RQaeR+KRFR3RzR1URJrCiuiNjH:NkWimoSmZM2q9y9sebjb5ZXUf2iuOj2s
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nodgel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nodgel32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niikceid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Niikceid.exe -
Berbew family
-
Executes dropped EXE 3 IoCs
pid Process 2820 Nodgel32.exe 2596 Niikceid.exe 2568 Nlhgoqhh.exe -
Loads dropped DLL 10 IoCs
pid Process 2728 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe 2728 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe 2820 Nodgel32.exe 2820 Nodgel32.exe 2596 Niikceid.exe 2596 Niikceid.exe 324 WerFault.exe 324 WerFault.exe 324 WerFault.exe 324 WerFault.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dnlbnp32.dll Nodgel32.exe File created C:\Windows\SysWOW64\Nlhgoqhh.exe Niikceid.exe File created C:\Windows\SysWOW64\Lamajm32.dll Niikceid.exe File opened for modification C:\Windows\SysWOW64\Nlhgoqhh.exe Niikceid.exe File created C:\Windows\SysWOW64\Nodgel32.exe 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe File opened for modification C:\Windows\SysWOW64\Nodgel32.exe 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe File created C:\Windows\SysWOW64\Cnjgia32.dll 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe File created C:\Windows\SysWOW64\Niikceid.exe Nodgel32.exe File opened for modification C:\Windows\SysWOW64\Niikceid.exe Nodgel32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 324 2568 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nodgel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niikceid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlhgoqhh.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnjgia32.dll" 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nodgel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nodgel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Niikceid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnlbnp32.dll" Nodgel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Niikceid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamajm32.dll" Niikceid.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2820 2728 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe 30 PID 2728 wrote to memory of 2820 2728 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe 30 PID 2728 wrote to memory of 2820 2728 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe 30 PID 2728 wrote to memory of 2820 2728 676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe 30 PID 2820 wrote to memory of 2596 2820 Nodgel32.exe 31 PID 2820 wrote to memory of 2596 2820 Nodgel32.exe 31 PID 2820 wrote to memory of 2596 2820 Nodgel32.exe 31 PID 2820 wrote to memory of 2596 2820 Nodgel32.exe 31 PID 2596 wrote to memory of 2568 2596 Niikceid.exe 32 PID 2596 wrote to memory of 2568 2596 Niikceid.exe 32 PID 2596 wrote to memory of 2568 2596 Niikceid.exe 32 PID 2596 wrote to memory of 2568 2596 Niikceid.exe 32 PID 2568 wrote to memory of 324 2568 Nlhgoqhh.exe 33 PID 2568 wrote to memory of 324 2568 Nlhgoqhh.exe 33 PID 2568 wrote to memory of 324 2568 Nlhgoqhh.exe 33 PID 2568 wrote to memory of 324 2568 Nlhgoqhh.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe"C:\Users\Admin\AppData\Local\Temp\676f09eb451285753e8504adff6895d1ccdafd74721a34bd2e400ce8350c1d89N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Nodgel32.exeC:\Windows\system32\Nodgel32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Niikceid.exeC:\Windows\system32\Niikceid.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Nlhgoqhh.exeC:\Windows\system32\Nlhgoqhh.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1405⤵
- Loads dropped DLL
- Program crash
PID:324
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD502a76abbb59cd74958ce667801e68518
SHA18489a6beabba9a8cb1bb1015164f893a7f435b18
SHA256484cd84081936b8f5eabb1dbeb7541996313a528bcf419f2a9e7f1f401f00ddc
SHA512d6181b2117c56b7101cc7c134ad95806a0362dd8475c560970202dad3bb000e56e73d3e8c8bd96cffd87a6a49961a28a960218df6ec5537df920205d0cdb6b1c
-
Filesize
89KB
MD52405d22365134f178def6d81bb54a317
SHA1c1513f111977f883685119fe31f485df3e7aa453
SHA256786015246772bd0fd62803c7c3cf92705d16973ba8db478a68f9948472c9b49c
SHA512765ae0b30b3daa1f3b7710b411c87371d6f594c2f1a3df9e68a53af10d6e675a310ced2e4b48bc00b46e2fbeb78f8d4aed23951095adcda0ea1c101173c70867
-
Filesize
89KB
MD5130530819e2c271ce9c47d6b1f511fc1
SHA17735a237b9bbe064a6d27166ec9b06444d5c8153
SHA256931cf6b0dc6f01a45bb7a802e15e508a2289431deadaf4979c439709f999a24a
SHA512e6b42731aec3631e3959fc4a5f189c9e88c0e1ab5749ecca0be18917d13cad65fed51c2d7cbdfea5d94d68cade12f90e41e4bf40f5905916752e8326231882e9