General

  • Target

    N0K-v3.exe

  • Size

    7.3MB

  • Sample

    241202-r7aezsyjgy

  • MD5

    66cb0645ac59985e73e2f0bf153c067a

  • SHA1

    41a934e186ababb688c26e8834cd56e90baa05c6

  • SHA256

    3f552e19dbdfa3a8d74b4a33369ae6d74efca83a06df7c0b7cf7700e69ca9318

  • SHA512

    50195bce0be69cc838ce9e74716a93b7915c61b836b418248c6a468c46737ff7a7e237a8662d9227faca1ac09a2db29b5ccf6d41cf0ccc3a265ece0f3ccb5c59

  • SSDEEP

    98304:3heYgZhUO6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBN3o1py:38YS65OshoKMuIkhVastRL5Di3u01D7b

Malware Config

Targets

    • Target

      N0K-v3.exe

    • Size

      7.3MB

    • MD5

      66cb0645ac59985e73e2f0bf153c067a

    • SHA1

      41a934e186ababb688c26e8834cd56e90baa05c6

    • SHA256

      3f552e19dbdfa3a8d74b4a33369ae6d74efca83a06df7c0b7cf7700e69ca9318

    • SHA512

      50195bce0be69cc838ce9e74716a93b7915c61b836b418248c6a468c46737ff7a7e237a8662d9227faca1ac09a2db29b5ccf6d41cf0ccc3a265ece0f3ccb5c59

    • SSDEEP

      98304:3heYgZhUO6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBN3o1py:38YS65OshoKMuIkhVastRL5Di3u01D7b

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks