Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
Tags
Common Information
Type | Value |
---|---|
UUID | 8937d4e8-dd18-427c-8626-6ac6645955e0 |
Fingerprint | a428a5dd2d2a85c3 |
Analysis status | DONE |
Considered CTI value | 2 |
Text language | |
Published | Sept. 30, 2024, 12:45 a.m. |
Added to db | Sept. 30, 2024, 2:54 a.m. |
Last updated | Oct. 12, 2024, 1:08 a.m. |
Headline | Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware |
Title | Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware |
Detected Hints/Tags/Attributes | 192/4/174 |
Source URLs
URL Provider
RSS Feed
Details | Id | Enabled | Feed title | Url | Added to db |
---|---|---|---|---|---|
Details | 249 | ✔ | The DFIR Report | https://thedfirreport.com/feed/ | 2024-08-30 22:08 |
Attributes
Details | Type | #Events | CTI | Value |
---|---|---|---|---|
Details | Domain | 2 | version.zip |
|
Details | Domain | 3 | slv.py |
|
Details | Domain | 2 | wo14.py |
|
Details | Domain | 2 | wo12.py |
|
Details | Domain | 2 | com.amazon.csm.csa.prod |
|
Details | Domain | 81 | www.amazon.com |
|
Details | Domain | 54 | www.cloudflare.com |
|
Details | Domain | 53 | hunt.io |
|
Details | Domain | 2 | restic.rest |
|
Details | Domain | 2 | worksliv.py |
|
Details | Domain | 10 | detection.fyi |
|
Details | Domain | 9 | sigmasearchengine.com |
|
Details | File | 2 | version.zip |
|
Details | File | 190 | setup.exe |
|
Details | File | 6 | python311.dll |
|
Details | File | 65 | python.exe |
|
Details | File | 3 | slv.py |
|
Details | File | 2 | wo14.py |
|
Details | File | 2 | wo12.py |
|
Details | File | 2 | c:\windows\adfs\py\updateedge.bat |
|
Details | File | 2 | c:\users\redacted\appdata\local\notepad\upedge.bat |
|
Details | File | 2 | c:\users\redacted\appdata\local\notepad\updateedge.bat |
|
Details | File | 2 | c:\users\redacted\appdata\local\notepad\updateeg.bat |
|
Details | File | 2 | windowstempupdate.exe |
|
Details | File | 2 | updateedge.bat |
|
Details | File | 1974 | cmd.exe |
|
Details | File | 9 | c:\windows\system32\userinit.exe |
|
Details | File | 203 | winlogon.exe |
|
Details | File | 2 | srv.txt |
|
Details | File | 2 | amazon.cs |
|
Details | File | 2 | m.cs |
|
Details | File | 2 | %windir%\syswow64\gpupdate.exe |
|
Details | File | 2 | %windir%\sysnative\gpupdate.exe |
|
Details | File | 479 | ntdll.dll |
|
Details | File | 679 | kernel32.dll |
|
Details | File | 3 | restic.exe |
|
Details | File | 2 | ppp.txt |
|
Details | File | 3 | up.bat |
|
Details | File | 55 | 1.bat |
|
Details | File | 11 | psexec64.exe |
|
Details | File | 3 | pc.txt |
|
Details | File | 2 | c:\example.exe |
|
Details | File | 18 | c:\windows\syswow64\cmd.exe |
|
Details | File | 387 | c:\windows\system32\cmd.exe |
|
Details | File | 2 | c:\windows\temp\2-redacted-51.exe |
|
Details | File | 15 | iisreset.exe |
|
Details | File | 326 | vssadmin.exe |
|
Details | File | 228 | wmic.exe |
|
Details | File | 88 | wevtutil.exe |
|
Details | File | 7 | example.exe |
|
Details | File | 2 | worksliv.py |
|
Details | File | 2 | updateeg.bat |
|
Details | File | 2 | 2-redacted-51.exe |
|
Details | File | 2 | domain_name.exe |
|
Details | File | 43 | nltest.exe |
|
Details | md5 | 23 | 72a589da586844d7f0818ce684948eea |
|
Details | md5 | 15 | f176ba63b4d68e576b5ba345bec2c7b7 |
|
Details | md5 | 2 | 1329384dfdcfde2228da94e2a042f2b4 |
|
Details | md5 | 2 | f27a9b7c29960aaf911f2885b40536c2 |
|
Details | md5 | 3 | 19e29534fd49dd27d09234e639c4057e |
|
Details | md5 | 3 | f4febc55ea12b31ae17cfb7e614afda8 |
|
Details | md5 | 2 | d6828e30ab66774a91a96ae93be4ae4c |
|
Details | md5 | 2 | DBF5F56998705C37076B6CAE5D0BFB4D |
|
Details | md5 | 2 | EB64862F1C8464CA3D03CF0A4AC608F4 |
|
Details | md5 | 2 | 3A4FDBC642A24A240692F9CA70757E9F |
|
Details | md5 | 2 | 7A4CB8261036F35FD273DA420BF0FD5E |
|
Details | md5 | 2 | 1BE7FE8E20F8E9FDC6FD6100DCAD38F3 |
|
Details | md5 | 2 | 4232C065029EB52D1B4596A08568E800 |
|
Details | md5 | 2 | 637FB65A1755C4B6DC1E0428E69B634E |
|
Details | md5 | 2 | 0B1882F719504799B3211BF73DFDC253 |
|
Details | md5 | 2 | E20FC97E364E859A2FB58D66BC2A1D05 |
|
Details | md5 | 2 | C737A137B66138371133404C38716741 |
|
Details | md5 | 2 | 7A1E7F652055C812644AD240C41D904A |
|
Details | md5 | 2 | E0D1CF0ABD09D7632F79A8259283288D |
|
Details | sha1 | 3 | e6ab3c595ac703afd94618d1ca1b8ebce623b21f |
|
Details | sha1 | 3 | 6f43e6388b64998b7aa7411104b955a8949c4c63 |
|
Details | sha1 | 3 | 794203a4e18f904f0d244c7b3c2f5126b58f6a21 |
|
Details | sha1 | 3 | 9648559769179677c5b58d5619ca8872f5086312 |
|
Details | sha1 | 3 | c4cde794cf4a68d63617458a60bc8b90d99823ca |
|
Details | sha1 | 3 | 79818110abd52ba14800cdff39eca3252412b232 |
|
Details | sha1 | 3 | fba4652b6dbe0948d4dadcebf51737a738ca9e67 |
|
Details | sha1 | 3 | 448892d5607124fdd520f62ff0bc972df801c046 |
|
Details | sha1 | 3 | f5f56413f81e8f4a941f53e42a90ba1720823f15 |
|
Details | sha1 | 3 | a3e4fb487400d99e3a9f3523aeaa9af5cf6e128b |
|
Details | sha1 | 3 | b39c244c3117f516ce5844b2a843eff1e839207c |
|
Details | sha1 | 3 | 3a78ce27a7aa16a8230668c644c7df308de6cf33 |
|
Details | sha256 | 3 | 5dc8b08c7e1b11abf2b6b311cd7e411db16a7c3827879c6f93bd0dac7a71d321 |
|
Details | sha256 | 3 | 726f038c13e4c90976811b462e6d21e10e05f7c11e35331d314c546d91fa6d21 |
|
Details | sha256 | 3 | 5f7d438945306bf8a7f35cab0e2acc80cdc9295a57798d8165ef6d8b86fbb38d |
|
Details | sha256 | 3 | 4ef1009923fc12c2a3127c929e0aa4515c9f4d068737389afb3464c28ccf5925 |
|
Details | sha256 | 3 | 4ee4e1e2cedf59a802c01fae9ccfcfde3e84764c72e7d95b97992addd6edf527 |
|
Details | sha256 | 3 | 3298629de0489c12e451152e787d294753515855dbf1ce80bfcded584a84ac62 |
|
Details | sha256 | 3 | b3b1ff7e3d1d4f438e40208464cebfb641b434f5bf5cf18b7cec2d189f52c1b6 |
|
Details | sha256 | 3 | 39ec2834494f384028ad17296f70ed6608808084ef403714cfbc1bfbbed263d4 |
|
Details | sha256 | 3 | 9514035fea8000a664799e369ae6d3af6abfe8e5cda23cdafbede83051692e63 |
|
Details | sha256 | 3 | 25172a046821bd04e74c15dc180572288c67fdff474bdb5eb11b76dce1b3dad3 |
|
Details | sha256 | 3 | 5fac60f1e97b6eaae18ebd8b49b912c86233cf77637590f36aa319651582d3c4 |
|
Details | sha256 | 3 | d15cab3901e9a10af772a0a1bdbf35b357ee121413d4cf542d96819dc4471158 |
|
Details | IPv4 | 3 | 91.92.250.65 |
|
Details | IPv4 | 3 | 91.92.250.60 |
|
Details | IPv4 | 4 | 118.0.0.0 |
|
Details | IPv4 | 2 | 91.92.240.175 |
|
Details | IPv4 | 2 | 91.92.240.194 |
|
Details | IPv4 | 2 | 91.92.241.117 |
|
Details | IPv4 | 2 | 91.92.242.182 |
|
Details | IPv4 | 2 | 91.92.242.39 |
|
Details | IPv4 | 2 | 91.92.242.55 |
|
Details | IPv4 | 2 | 91.92.245.174 |
|
Details | IPv4 | 2 | 91.92.245.175 |
|
Details | IPv4 | 2 | 91.92.247.123 |
|
Details | IPv4 | 2 | 91.92.247.127 |
|
Details | IPv4 | 2 | 91.92.249.110 |
|
Details | IPv4 | 2 | 91.92.250.148 |
|
Details | IPv4 | 2 | 91.92.250.158 |
|
Details | IPv4 | 2 | 91.92.250.66 |
|
Details | IPv4 | 2 | 91.92.251.240 |
|
Details | IPv4 | 2 | 94.156.67.175 |
|
Details | IPv4 | 2 | 94.156.67.180 |
|
Details | IPv4 | 2 | 94.156.67.185 |
|
Details | IPv4 | 2 | 94.156.67.188 |
|
Details | IPv4 | 2 | 141.98.6.195 |
|
Details | IPv4 | 2 | 193.42.33.14 |
|
Details | IPv4 | 2 | 194.180.48.165 |
|
Details | IPv4 | 2 | 194.180.48.42 |
|
Details | IPv4 | 2 | 194.49.94.21 |
|
Details | IPv4 | 2 | 194.49.94.22 |
|
Details | IPv4 | 2 | 185.73.124.238 |
|
Details | IPv4 | 3 | 194.49.94.18 |
|
Details | IPv4 | 3 | 194.169.175.134 |
|
Details | IPv4 | 3 | 195.123.226.84 |
|
Details | IPv4 | 3 | 91.92.245.26 |
|
Details | MITRE ATT&CK Techniques | 99 | T1098 |
|
Details | MITRE ATT&CK Techniques | 82 | T1070.001 |
|
Details | MITRE ATT&CK Techniques | 411 | T1486 |
|
Details | MITRE ATT&CK Techniques | 65 | T1039 |
|
Details | MITRE ATT&CK Techniques | 190 | T1574.002 |
|
Details | MITRE ATT&CK Techniques | 66 | T1069.002 |
|
Details | MITRE ATT&CK Techniques | 115 | T1482 |
|
Details | MITRE ATT&CK Techniques | 171 | T1189 |
|
Details | MITRE ATT&CK Techniques | 56 | T1055.001 |
|
Details | MITRE ATT&CK Techniques | 10 | T1027.013 |
|
Details | MITRE ATT&CK Techniques | 84 | T1048 |
|
Details | MITRE ATT&CK Techniques | 439 | T1105 |
|
Details | MITRE ATT&CK Techniques | 254 | T1490 |
|
Details | MITRE ATT&CK Techniques | 108 | T1570 |
|
Details | MITRE ATT&CK Techniques | 65 | T1087.001 |
|
Details | MITRE ATT&CK Techniques | 29 | T1069.001 |
|
Details | MITRE ATT&CK Techniques | 159 | T1003.001 |
|
Details | MITRE ATT&CK Techniques | 330 | T1204.002 |
|
Details | MITRE ATT&CK Techniques | 324 | T1036 |
|
Details | MITRE ATT&CK Techniques | 153 | T1036.005 |
|
Details | MITRE ATT&CK Techniques | 163 | T1135 |
|
Details | MITRE ATT&CK Techniques | 403 | T1059.001 |
|
Details | MITRE ATT&CK Techniques | 414 | T1055 |
|
Details | MITRE ATT&CK Techniques | 53 | T1059.006 |
|
Details | MITRE ATT&CK Techniques | 151 | T1021.001 |
|
Details | MITRE ATT&CK Techniques | 224 | T1018 |
|
Details | MITRE ATT&CK Techniques | 24 | T1562.009 |
|
Details | MITRE ATT&CK Techniques | 245 | T1053.005 |
|
Details | MITRE ATT&CK Techniques | 155 | T1569.002 |
|
Details | MITRE ATT&CK Techniques | 126 | T1021.002 |
|
Details | MITRE ATT&CK Techniques | 380 | T1071.001 |
|
Details | MITRE ATT&CK Techniques | 296 | T1059.003 |
|
Details | MITRE ATT&CK Techniques | 294 | T1047 |
|
Details | MITRE ATT&CK Techniques | 18 | T1547.004 |
|
Details | Url | 5 | https://www.amazon.com |
|
Details | Url | 4 | https://www.cloudflare.com |
|
Details | Url | 2 | http://195.123.226.84:8000 |
|
Details | Windows Registry Key | 7 | HKLM\software\microsoft\windows |
|
Details | Windows Registry Key | 3 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce |
|
Details | Windows Registry Key | 157 | HKLM\SOFTWARE\Microsoft\Windows |
|
Details | Windows Registry Key | 2 | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\15991160457623399845550968347370640942 |
|
Details | Windows Registry Key | 2 | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\15991160457623399845550968347370640942 |
|
Details | Windows Registry Key | 17 | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters |