Overview
overview
10Static
static
10nexus-valo...EY.exe
windows7-x64
7nexus-valo...EY.exe
windows10-2004-x64
7nexus-valo...TO.exe
windows7-x64
1nexus-valo...TO.exe
windows10-2004-x64
1nexus-valo...th.dll
windows7-x64
1nexus-valo...th.dll
windows10-2004-x64
1nexus-valo...tk.dll
windows7-x64
8nexus-valo...tk.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 09:45
Behavioral task
behavioral1
Sample
nexus-valo-checker-main/AUTHKEY.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
nexus-valo-checker-main/AUTHKEY.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
nexus-valo-checker-main/Nexus_PTO.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
nexus-valo-checker-main/Nexus_PTO.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
nexus-valo-checker-main/PTOAuth.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
nexus-valo-checker-main/PTOAuth.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
nexus-valo-checker-main/stk.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
nexus-valo-checker-main/stk.dll
Resource
win10v2004-20250129-en
General
-
Target
nexus-valo-checker-main/AUTHKEY.exe
-
Size
24.1MB
-
MD5
10915cf6269d9e936c006c3947efcde3
-
SHA1
52101c768151144faf3460eea47fc3c9a8cf4e17
-
SHA256
f47adecb91fae9d810102b39ff6be179e73fdb4f1aca13e50aa890a78b11de9c
-
SHA512
7b165fbbdeb1e53004f468c54613bc30e6b88f77caf580129831085f9e62e274d594887ef55d5e25a2b1f796a6352437b87f51d6cee826b8c44b7ba24bdd8cc1
-
SSDEEP
393216:/qPnLFXlr2ZzvdV14A+QhZw/UDOETgsvcGAhgndpMY3/66/TKmCP/:SPLFXN6zWA+QXuEa8kw/6x
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2932 AUTHKEY.exe -
resource yara_rule behavioral1/files/0x000500000001c882-135.dat upx behavioral1/memory/2932-137-0x000007FEF6320000-0x000007FEF678E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2932 1276 AUTHKEY.exe 30 PID 1276 wrote to memory of 2932 1276 AUTHKEY.exe 30 PID 1276 wrote to memory of 2932 1276 AUTHKEY.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\nexus-valo-checker-main\AUTHKEY.exe"C:\Users\Admin\AppData\Local\Temp\nexus-valo-checker-main\AUTHKEY.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\nexus-valo-checker-main\AUTHKEY.exe"C:\Users\Admin\AppData\Local\Temp\nexus-valo-checker-main\AUTHKEY.exe"2⤵
- Loads dropped DLL
PID:2932
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378