Overview

overview

10

Static

static

10

malware_10...er.exe

windows7-x64

10

malware_10...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2025 16:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    malware_10_netfilter.exe

  • Size

    113KB

  • MD5

    1c3db7002523e1acd621c90701c694ae

  • SHA1

    aee092fd31772d33932a7a02dd2d73ede67f7db0

  • SHA256

    d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe

  • SHA512

    e94cd7fa788fa2f828dd40fe096b25655d7b8fe9fd948c5b53f6c30039ca0b9c309ebf8619c0de6988ef5efb4db0b0683c9ddc63ad200aa5e88b8f01a9294f1b

  • SSDEEP

    1536:HL9RWXOQwi6wEBxmTSp3EpoNyq+4lRX6IHOSyOVi77:rLKOQwNOT+eFq+4lAvOi7

Score
10/10
netfilterdiscoverypersistencerootkit

Malware Config

Signatures

  • NetFilter

    NetFilter is a rootkit first seen in June 2021.

    rootkitnetfilter
  • Netfilter family
    netfilter
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\malware_10_netfilter.exe
    "C:\Users\Admin\AppData\Local\Temp\malware_10_netfilter.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Windows\SysWOW64\regini.exe
      "C:\Windows\System32\regini.exe" c.xalm
      2⤵
      • Sets service image path in registry
      PID:3808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c.xalm
    Filesize

    270B

    MD5

    e4a1a575a3c19abc5ff8fd9f3fece159

    SHA1

    d15d4c436faeb642871c33932da2f31e265d200c

    SHA256

    60c77aa3a588cb9c807d934f0352fbedc9e64046a972f1ad9fdbf229c9158a26

    SHA512

    23f01e80234f19ce071646b978646279bc1d8f883248c405e2e10ac75d8f67fc08d4109fc87a7021ccec3ae083c53e78c62045383d25622115cd05b0e6972fff

    Download Submit