b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
1511s
max time network
1527s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13-12-2024 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Virus/Gnil/Gnil.exe
Size

73KB
MD5

37e887b7a048ddb9013c8d2a26d5b740
SHA1

713b4678c05a76dbd22e6f8d738c9ef655e70226
SHA256

24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b
SHA512

99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af
SSDEEP

1536:UGNxwGlpPADH11dcbvbc7ysHJq18/H0UMC96hIoUShbs:UGNJA73dcbvbc7jpe8/UoRhes

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	spoclsv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoclsv.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5124	Gnil.exe
5124	Gnil.exe
5124	Gnil.exe
5124	Gnil.exe
5124	Gnil.exe
5124	Gnil.exe
4996	spoclsv.exe
4996	spoclsv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 4996	5124	Gnil.exe	80
PID 5124 wrote to memory of 4996	5124	Gnil.exe	80
PID 5124 wrote to memory of 4996	5124	Gnil.exe	80

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\spoclsv.exe

Filesize
73KB

MD5
37e887b7a048ddb9013c8d2a26d5b740

SHA1
713b4678c05a76dbd22e6f8d738c9ef655e70226

SHA256
24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b

SHA512
99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af

Download Submit
memory/4996-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5124-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5124-1-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/5124-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download