f434c9f975989854dfdec7e644dbf9505bdd2db43c992a9c6fee7b6c98dc510b

General

Target
NEW.zip
Size 68.6MB
Sample260806-sd2stadq4t
SHA256 f434c9f975989854dfdec7e644dbf9505bdd2db43c992a9c6fee7b6c98dc510b
MD5 328f48c4d76cc6104ef20358bb78b60d
SHA1 192332324a895e5857b77d24cb0a0ad4c48852e8
SHA512 4af6456ab4f3194056a4789077a5e16a7e4278ac9ea5ef7196eabc4a684d8bbbe6ee9a25f4bd0ee32a9f595c1fa706dfe415c85224dfe7954c08e5f884d2eae9
SSDEEP 1572864:RUhuHKwACu0h0y1PqUbV0Mq3woTKmMQMwYQZ8J2hFnwlF47:2PwFuAR1Pqua13wR/QMDO8J2h6F2
TLSH
T147F733B0CD951CC5B8C76341B8A1AE7D37A848A9538AEC71FCE7E7C5DA239707476880
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4652	netsh.exe
2624	netsh.exe
2232	netsh.exe
2600	netsh.exe
4612	netsh.exe
1584	netsh.exe
3748	netsh.exe
3796	netsh.exe
4948	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2212	host.exe
3900	host.exe

Loads dropped DLL 2 IoCs

pid	Process
3900	host.exe
4764	1_nexora_complete.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2212	host.exe
3900	host.exe
3900	host.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
720	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4764	1_nexora_complete.exe
4764	1_nexora_complete.exe
4764	1_nexora_complete.exe
4764	1_nexora_complete.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	1_nexora_complete.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4652	720	cmd.exe	109
PID 720 wrote to memory of 3796	720	cmd.exe	110
PID 720 wrote to memory of 2624	720	cmd.exe	111
PID 720 wrote to memory of 2232	720	cmd.exe	112
PID 720 wrote to memory of 2600	720	cmd.exe	113
PID 720 wrote to memory of 4612	720	cmd.exe	114
PID 720 wrote to memory of 1584	720	cmd.exe	115
PID 720 wrote to memory of 4948	720	cmd.exe	116
PID 720 wrote to memory of 3748	720	cmd.exe	117
PID 4764 wrote to memory of 2212	4764	1_nexora_complete.exe	120
PID 4764 wrote to memory of 3900	4764	1_nexora_complete.exe	122

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\NEW.zip
1⤵
PID:4404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\NEW\yonetici calistir sonra loaderi aç.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4652
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3796
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2624
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2232
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2600
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4612
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1584
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4948
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall set rule all new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3748

C:\Users\Admin\Desktop\NEW\1_nexora_complete.exe
"C:\Users\Admin\Desktop\NEW\1_nexora_complete.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\NexoraLoader_34852c1c40294d468ecdf289a375a49a\host.exe
  "C:\Users\Admin\AppData\Local\Temp\NexoraLoader_34852c1c40294d468ecdf289a375a49a\host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\NexoraLoader_34852c1c40294d468ecdf289a375a49a\host.exe
  "C:\Users\Admin\AppData\Local\Temp\NexoraLoader_34852c1c40294d468ecdf289a375a49a\host.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebViewPatch.dll

Path C:\Users\Admin\AppData\Local\Temp\NexoraLoader_34852c1c40294d468ecdf289a375a49a\WebViewPatch.dll
Size 104KB
SHA256 6b098efd981a88b5a2fc74234c266b17509556ea3cfc8f36bae2a3168854c0d3
MD5 d9613ab0618b3506c62df39c7b144a56
SHA1 aa430fed8eb140a91a9f9de0d1c2399e4801d212
SHA512 7f1bc2486bde65074c2bb7046dc474dc9e0eafc626e2067358b85499d163738cf4bb6b9f957c0bf0a9f232df9fa0c7e8ecb230321998cbdd035c3b821afc30c4
SSDEEP 1536:0XEnNbEJXxG8dU0pZeq1sz+7H8SDs6hEKDVUhd8S6WEViErsW6MdR9dlET+7vQf:caEhxGj03cOcY6KDVwHEiEwWp/Uf3w
TLSH
T1DBA34A57B7A940BBE173963C84974A49E732B81147619FEF03A4026A2F233D59D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Users\Admin\AppData\Local\Temp\NexoraLoader_34852c1c40294d468ecdf289a375a49a\host.exe
Size 37.5MB
SHA256 589ac1013ae37cf77033848c3313753e336c054728d8f1aa0984b57be4d397a1
MD5 b0f68525563628d8f44831a405f235c6
SHA1 11733464433dc7efc28401b884e0d10a2421b051
SHA512 72020ea0adae76df9121eecc3d11569dc20abcd6530a2d6cf2726baee900fe0bcbaea58bd508df5625d20f48717b3e45cf1d0be4ce6a53170aafb7ad929eba31
SSDEEP 786432:0KPfgLDIWJcEB4UsX4Mi5lQ2i07FRbdHSQqrERGh5z2SLRF4rU1:VHgpCUQ4Mi56sZvq4RIRerU1
TLSH
T1888733E368C071E4E0E74E02B24AA3BD61D26D16599B4C1D2AC23D436F31DF69B0ED97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4764-0-0x00000000007F0000-0x0000000004CC8000-memory.dmp

Download

memory/4764-1-0x0000000005680000-0x0000000005692000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads