General
-
Target
nitrogen.exe
-
Size
5.8MB
-
Sample
241119-vfn1vayhml
-
MD5
6c54a9ec65d3040ba46c5d3f1b3faede
-
SHA1
28fa5ec10f34d29b7eb02664e64f6d8f72120874
-
SHA256
cc16442e6554b7001f4d23d1782dfd5a6836df2c2dc8e409dda921ea3ae8cb93
-
SHA512
3f26c79bd10b4c4ea9279222186e0a731dfd50ddda22530d4092461e05ea1988364b865ee50ff2260c4eb06adf6ef18765e4e56f4d19c62be425bfe653a040e8
-
SSDEEP
98304:IrrwmDSuXXO8RHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nuL:IrrwmDZ7RHvUWvozWOxu9kXwvdbDlA06
Behavioral task
behavioral1
Sample
nitrogen.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
nitrogen.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
nitrogen.exe
-
Size
5.8MB
-
MD5
6c54a9ec65d3040ba46c5d3f1b3faede
-
SHA1
28fa5ec10f34d29b7eb02664e64f6d8f72120874
-
SHA256
cc16442e6554b7001f4d23d1782dfd5a6836df2c2dc8e409dda921ea3ae8cb93
-
SHA512
3f26c79bd10b4c4ea9279222186e0a731dfd50ddda22530d4092461e05ea1988364b865ee50ff2260c4eb06adf6ef18765e4e56f4d19c62be425bfe653a040e8
-
SSDEEP
98304:IrrwmDSuXXO8RHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nuL:IrrwmDZ7RHvUWvozWOxu9kXwvdbDlA06
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3