Analysis
-
max time kernel
125s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2025, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
NitroGen.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
NitroGen.exe
Resource
win10v2004-20250217-en
General
-
Target
NitroGen.exe
-
Size
335KB
-
MD5
dafb1f4e1689f2d2225d73bf26eb5da6
-
SHA1
17edf7a8771fb20d0e9543779915db2d189b42d6
-
SHA256
154acc8a3f62a30a3c89c175bac5121019f5c40f6eb2677a2bd29b59e38e623c
-
SHA512
4a1e71feb6946655d08139bfcd4314657e10ccecf8a23556d3b5e52eb1e534c7178f7f0de7c9d70e81e32129329f7062635f4bd053ab01a2e5838cd3c3c4a835
-
SSDEEP
6144:W5VP9Ge3+hoAvdeJBbLncZc6zyuyGG6RE74AsnAYLk/KTHNS:W5393whFOBbCzyc8rMjtS
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Nitro family
-
Renames multiple (105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation NitroGen.exe Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation NitroRansomware.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.givemenitro NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini NitroRansomware.exe -
Executes dropped EXE 1 IoCs
pid Process 3692 NitroRansomware.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NitroGen\\NitroRansomware.exe\"" NitroRansomware.exe -
Drops desktop.ini file(s) 11 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini NitroRansomware.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini NitroRansomware.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 15 discord.com 16 discord.com 23 discord.com 27 discord.com 34 discord.com 56 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 14 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" NitroRansomware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NitroGen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NitroRansomware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3460 regedit.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3692 NitroRansomware.exe 3692 NitroRansomware.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3692 NitroRansomware.exe Token: SeIncreaseQuotaPrivilege 4824 WMIC.exe Token: SeSecurityPrivilege 4824 WMIC.exe Token: SeTakeOwnershipPrivilege 4824 WMIC.exe Token: SeLoadDriverPrivilege 4824 WMIC.exe Token: SeSystemProfilePrivilege 4824 WMIC.exe Token: SeSystemtimePrivilege 4824 WMIC.exe Token: SeProfSingleProcessPrivilege 4824 WMIC.exe Token: SeIncBasePriorityPrivilege 4824 WMIC.exe Token: SeCreatePagefilePrivilege 4824 WMIC.exe Token: SeBackupPrivilege 4824 WMIC.exe Token: SeRestorePrivilege 4824 WMIC.exe Token: SeShutdownPrivilege 4824 WMIC.exe Token: SeDebugPrivilege 4824 WMIC.exe Token: SeSystemEnvironmentPrivilege 4824 WMIC.exe Token: SeRemoteShutdownPrivilege 4824 WMIC.exe Token: SeUndockPrivilege 4824 WMIC.exe Token: SeManageVolumePrivilege 4824 WMIC.exe Token: 33 4824 WMIC.exe Token: 34 4824 WMIC.exe Token: 35 4824 WMIC.exe Token: 36 4824 WMIC.exe Token: SeIncreaseQuotaPrivilege 4824 WMIC.exe Token: SeSecurityPrivilege 4824 WMIC.exe Token: SeTakeOwnershipPrivilege 4824 WMIC.exe Token: SeLoadDriverPrivilege 4824 WMIC.exe Token: SeSystemProfilePrivilege 4824 WMIC.exe Token: SeSystemtimePrivilege 4824 WMIC.exe Token: SeProfSingleProcessPrivilege 4824 WMIC.exe Token: SeIncBasePriorityPrivilege 4824 WMIC.exe Token: SeCreatePagefilePrivilege 4824 WMIC.exe Token: SeBackupPrivilege 4824 WMIC.exe Token: SeRestorePrivilege 4824 WMIC.exe Token: SeShutdownPrivilege 4824 WMIC.exe Token: SeDebugPrivilege 4824 WMIC.exe Token: SeSystemEnvironmentPrivilege 4824 WMIC.exe Token: SeRemoteShutdownPrivilege 4824 WMIC.exe Token: SeUndockPrivilege 4824 WMIC.exe Token: SeManageVolumePrivilege 4824 WMIC.exe Token: 33 4824 WMIC.exe Token: 34 4824 WMIC.exe Token: 35 4824 WMIC.exe Token: 36 4824 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3692 NitroRansomware.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3692 NitroRansomware.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3732 wrote to memory of 3692 3732 NitroGen.exe 87 PID 3732 wrote to memory of 3692 3732 NitroGen.exe 87 PID 3732 wrote to memory of 3692 3732 NitroGen.exe 87 PID 3692 wrote to memory of 4564 3692 NitroRansomware.exe 90 PID 3692 wrote to memory of 4564 3692 NitroRansomware.exe 90 PID 3692 wrote to memory of 4564 3692 NitroRansomware.exe 90 PID 3692 wrote to memory of 4436 3692 NitroRansomware.exe 92 PID 3692 wrote to memory of 4436 3692 NitroRansomware.exe 92 PID 3692 wrote to memory of 4436 3692 NitroRansomware.exe 92 PID 4436 wrote to memory of 4824 4436 cmd.exe 94 PID 4436 wrote to memory of 4824 4436 cmd.exe 94 PID 4436 wrote to memory of 4824 4436 cmd.exe 94 PID 4564 wrote to memory of 3460 4564 cmd.exe 95 PID 4564 wrote to memory of 3460 4564 cmd.exe 95 PID 4564 wrote to memory of 3460 4564 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\NitroGen.exe"C:\Users\Admin\AppData\Local\Temp\NitroGen.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe"C:\Users\Admin\AppData\Local\Temp\NitroGen\NitroRansomware.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NitroGen\patch.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\regedit.exeregedit /s Patch.reg4⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3460
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD584f3e8dc3f19e03950598b7005774ada
SHA1865be991b10c71182f56e30e24ca75a5ca111ec7
SHA256907b0951967bba240caa38494f1607e3e3acf3ff9557efd1d292a9bc12e199b9
SHA512723f3166380bfd9aee957998b8acf6f0f8f17ef8284184df606836e769c0f7c1aac6c1bd860b35c49b11145e905889d75917fd69def415c07425007f181713bf
-
Filesize
184B
MD5cc46a0995713ba7cb577b4bbbedf83e8
SHA16cc50a0e444e33f65d42423195ed045a3a55daf8
SHA2565fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e
SHA51236f5b3acbc520504cfe56e5fe19de2a22ae3d2ddddb4c0eb3e441f884033077fb411e69976c3e250c3ef01189d0e48016bde67a73a0dbc950dd5d8ec7783fd2a
-
Filesize
310B
MD5ea2cb363e38635a29fc698b78d59019d
SHA17b2fd924efcf1595e8fccae40b6137a7c63506d6
SHA2560af6a21526ab47e7d53dbab649602e64bb5f2dafa27d9cc200572e6dbe22a030
SHA5125a525f264a915062def515f58e20d0c539b0f9ccd5d40585e074e2e7ae37f0d8205d40db278f7cbd98d61d816dcc9450d4d7084483602eb5b7d9c9a8bfa5551e
-
Filesize
37B
MD50a026d1d64eb8576241e8c4cfa642dc1
SHA126ae22c596114300041c676e27393f2bc5c1bc6c
SHA2569a2c5d55b344f88a35839c62f2dd4a58b8d17a027892947f137f52ec13cba422
SHA512d9100a8e0cca6c85d24fbe7b064fda68cae88e45e31df2bc21cb4d0a6b3694a50011db0da3eb4f9288557d278eb1b6b824213d73611601f429dd8eafc2d48e96