Overview
overview
10Static
static
10niha-main/OmNom.exe
windows10-ltsc_2021-x64
10niha-main/alfa.exe
windows10-ltsc_2021-x64
8niha-main/derq.exe
windows10-ltsc_2021-x64
10niha-main/...af.exe
windows10-ltsc_2021-x64
7niha-main/...dr.exe
windows10-ltsc_2021-x64
7niha-main/...ra.exe
windows10-ltsc_2021-x64
10niha-main/kiprea2.exe
windows10-ltsc_2021-x64
10niha-main/kkk.exe
windows10-ltsc_2021-x64
10niha-main/...as.exe
windows10-ltsc_2021-x64
10niha-main/...wr.exe
windows10-ltsc_2021-x64
10niha-main/...ij.exe
windows10-ltsc_2021-x64
10niha-main/...12.exe
windows10-ltsc_2021-x64
10niha-main/...sr.exe
windows10-ltsc_2021-x64
10niha-main/...as.exe
windows10-ltsc_2021-x64
10niha-main/opiww1.exe
windows10-ltsc_2021-x64
10niha-main/...na.exe
windows10-ltsc_2021-x64
10niha-main/...t1.exe
windows10-ltsc_2021-x64
10niha-main/...ad.exe
windows10-ltsc_2021-x64
niha-main/...ed.exe
windows10-ltsc_2021-x64
8niha-main/pypdwat.exe
windows10-ltsc_2021-x64
7niha-main/...12.exe
windows10-ltsc_2021-x64
10niha-main/robobob.exe
windows10-ltsc_2021-x64
10niha-main/swi.exe
windows10-ltsc_2021-x64
10niha-main/thiakdc.exe
windows10-ltsc_2021-x64
10niha-main/...ka.exe
windows10-ltsc_2021-x64
8niha-main/time.exe
windows10-ltsc_2021-x64
10niha-main/vosemOO.exe
windows10-ltsc_2021-x64
10niha-main/wint1.exe
windows10-ltsc_2021-x64
10niha-main/wint2.exe
windows10-ltsc_2021-x64
10Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250410-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
16/04/2025, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
niha-main/OmNom.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
niha-main/alfa.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral3
Sample
niha-main/derq.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral4
Sample
niha-main/inktkisaf.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral5
Sample
niha-main/iotjsjawdr.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral6
Sample
niha-main/iylksfkktra.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral7
Sample
niha-main/kiprea2.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral8
Sample
niha-main/kkk.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral9
Sample
niha-main/liladertoas.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
niha-main/lporjgjsawr.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral11
Sample
niha-main/mbyoitksfjkyij.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral12
Sample
niha-main/mixerat12.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral13
Sample
niha-main/nerialtersr.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral14
Sample
niha-main/ninahoooas.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral15
Sample
niha-main/opiww1.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral16
Sample
niha-main/plorestoana.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral17
Sample
niha-main/poratertosat1.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral18
Sample
niha-main/pothgkjad.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral19
Sample
niha-main/potphbksed.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
niha-main/pypdwat.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral21
Sample
niha-main/rigosae12.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral22
Sample
niha-main/robobob.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral23
Sample
niha-main/swi.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral24
Sample
niha-main/thiakdc.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral25
Sample
niha-main/tiadktka.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral26
Sample
niha-main/time.exe
Resource
win10ltsc2021-20250410-en
Behavioral task
behavioral27
Sample
niha-main/vosemOO.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral28
Sample
niha-main/wint1.exe
Resource
win10ltsc2021-20250410-en
General
-
Target
niha-main/inktkisaf.exe
-
Size
27KB
-
MD5
2ff8e057084b5c180e9b447e08d2d747
-
SHA1
92b35c1b8f72c18dd3e945743cb93e8531d73e2b
-
SHA256
accdada8772018e58baa0ecb3e79c507eb09c7d67f22f59e323c74b51eac9072
-
SHA512
7ae542c6ca36e5ed934ca503f3489144e0ec7d81ad246af88bb525cb494f6725df0aa9131c72afe79ff02364dd65ec7a3ffb01846f99836feff06746193af251
-
SSDEEP
384:9XKCifuPVcppE4KeEdAl7H0I4GSFdr0NAbybMAf3L+9tHmXel7xI:96CiWPVypE4QalMZmoZ3Hmw7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3528707984-280903734-2966936111-1000\Control Panel\International\Geo\Nation inktkisaf.exe Key value queried \REGISTRY\USER\S-1-5-21-3528707984-280903734-2966936111-1000\Control Panel\International\Geo\Nation service.exe -
Executes dropped EXE 1 IoCs
pid Process 5240 service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktkisaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5172 schtasks.exe 4416 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3320 wrote to memory of 4488 3320 inktkisaf.exe 81 PID 3320 wrote to memory of 4488 3320 inktkisaf.exe 81 PID 3320 wrote to memory of 4488 3320 inktkisaf.exe 81 PID 4488 wrote to memory of 5172 4488 cmd.exe 83 PID 4488 wrote to memory of 5172 4488 cmd.exe 83 PID 4488 wrote to memory of 5172 4488 cmd.exe 83 PID 5240 wrote to memory of 1320 5240 service.exe 86 PID 5240 wrote to memory of 1320 5240 service.exe 86 PID 5240 wrote to memory of 1320 5240 service.exe 86 PID 1320 wrote to memory of 4416 1320 cmd.exe 88 PID 1320 wrote to memory of 4416 1320 cmd.exe 88 PID 1320 wrote to memory of 4416 1320 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\niha-main\inktkisaf.exe"C:\Users\Admin\AppData\Local\Temp\niha-main\inktkisaf.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn GoogleUpdaterex /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn GoogleUpdaterex /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5172
-
-
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn GoogleUpdaterex /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn GoogleUpdaterex /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4416
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD52ff8e057084b5c180e9b447e08d2d747
SHA192b35c1b8f72c18dd3e945743cb93e8531d73e2b
SHA256accdada8772018e58baa0ecb3e79c507eb09c7d67f22f59e323c74b51eac9072
SHA5127ae542c6ca36e5ed934ca503f3489144e0ec7d81ad246af88bb525cb494f6725df0aa9131c72afe79ff02364dd65ec7a3ffb01846f99836feff06746193af251