Overview

overview

9

Static

static

3

nte_574c0c...7c.exe

windows10-2004-x64

6

nte_574c0c...7c.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...in.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

NTEGlobal/...er.exe

windows10-2004-x64

9

NTEGlobal/...er.exe

windows11-ltsc_2024-x64

9

NTEGlobal/...te.exe

windows10-2004-x64

9

NTEGlobal/...te.exe

windows11-ltsc_2024-x64

9

NTEGlobal/peFlag.exe

windows10-2004-x64

3

NTEGlobal/peFlag.exe

windows11-ltsc_2024-x64

3

NTEGlobalLauncher.exe

windows10-2004-x64

9

NTEGlobalLauncher.exe

windows11-ltsc_2024-x64

9

uninst.exe

windows10-2004-x64

4

uninst.exe

windows11-ltsc_2024-x64

4

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...in.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    nte_574c0cbc37b8c30d19de76eafa20507c.exe
  • Size 53.9MB
  • Sample260718-n3fvesaw8p
  • SHA256 345e84bab04f24b0ec4907e297569586ef155087ecc1732f88757e7eb94a4994
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryransomware

Malware Config

Targets

    • Target
      nte_574c0cbc37b8c30d19de76eafa20507c.exe
    • Size 53.9MB
    • SHA256 345e84bab04f24b0ec4907e297569586ef155087ecc1732f88757e7eb94a4994
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/BgWorker.dll
    • Size 2KB
    • SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsWmInstallerPlugin.dll
    • Size 51.2MB
    • SHA256 9f03c9591a50ea9c58f4b858a6f550335764f63a4533d9d7e63f8a9891651b05
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 438KB
    • SHA256 689e0e89b413b7977ee51bfb932f2a7955826c2d186d3bdabacab46189a54421
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      NTEGlobal/NTEGlobalLauncher.exe
    • Size 535KB
    • SHA256 0a5fd2ebbb91710585183c760e99a3d5ba8198abdc23625fac912c0733497047
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    discoveryransomware

    • Renames multiple (684) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral15behavioral16
    • Target
      NTEGlobal/NTEGlobalUpdate.exe
    • Size 1.7MB
    • SHA256 a3622690a44510ca5c4cf3302878ccd04693c39a8ea7f1ad5a3b5353eb67d917
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    discoveryransomware

    • Renames multiple (684) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral17behavioral18
    • Target
      NTEGlobal/peFlag.exe
    • Size 149KB
    • SHA256 fae9ba71444b966d76df871249ff102dc7e95784203ec11ef11552253c33a89b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      NTEGlobalLauncher.exe
    • Size 535KB
    • SHA256 0a5fd2ebbb91710585183c760e99a3d5ba8198abdc23625fac912c0733497047
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    discoveryransomware

    • Renames multiple (684) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral21behavioral22
    • Target
      uninst.exe
    • Size 32.4MB
    • SHA256 72a7db06d7a0229557e59848721805f33ce957fd47d77d1a609b2fd42f89f36a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral23behavioral24
    • Target
      $PLUGINSDIR/BgWorker.dll
    • Size 2KB
    • SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      $PLUGINSDIR/nsWmInstallerPlugin.dll
    • Size 51.2MB
    • SHA256 9f03c9591a50ea9c58f4b858a6f550335764f63a4533d9d7e63f8a9891651b05
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discovery
Score
6/10

behavioral2

discovery
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discoveryransomware
Score
9/10

behavioral16

discoveryransomware
Score
9/10

behavioral17

discoveryransomware
Score
9/10

behavioral18

discoveryransomware
Score
9/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discoveryransomware
Score
9/10

behavioral22

discoveryransomware
Score
9/10

behavioral23

discovery
Score
4/10

behavioral24

discovery
Score
4/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10