b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Virus/Gnil/Gnil.exe
Size

73KB
MD5

37e887b7a048ddb9013c8d2a26d5b740
SHA1

713b4678c05a76dbd22e6f8d738c9ef655e70226
SHA256

24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b
SHA512

99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af
SSDEEP

1536:UGNxwGlpPADH11dcbvbc7ysHJq18/H0UMC96hIoUShbs:UGNJA73dcbvbc7jpe8/UoRhes

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	spoclsv.exe

Loads dropped DLL 2 IoCs

pid	Process
2312	Gnil.exe
2312	Gnil.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2312	Gnil.exe
2312	Gnil.exe
2312	Gnil.exe
2748	spoclsv.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2748	2312	Gnil.exe	30
PID 2312 wrote to memory of 2748	2312	Gnil.exe	30
PID 2312 wrote to memory of 2748	2312	Gnil.exe	30
PID 2312 wrote to memory of 2748	2312	Gnil.exe	30

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\spoclsv.exe

Filesize
73KB

MD5
37e887b7a048ddb9013c8d2a26d5b740

SHA1
713b4678c05a76dbd22e6f8d738c9ef655e70226

SHA256
24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b

SHA512
99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af

Download Submit
memory/2312-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2312-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2312-11-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/2312-10-0x0000000000310000-0x0000000000354000-memory.dmp

Filesize
272KB

Download
memory/2312-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2748-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2748-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download