Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
Tags
cmtmf-attack-pattern: Masquerading Process Injection
country: Bulgaria Netherlands
maec-delivery-vectors: Watering Hole
attack-pattern: Data Model Clear Windows Event Logs - T1070.001 Credentials - T1589.001 Data Encrypted For Impact - T1471 Data Encrypted For Impact - T1486 Dll Side-Loading - T1574.002 Dns - T1071.004 Dns - T1590.002 Domain Groups - T1069.002 Domain Trust Discovery - T1482 Drive-By Compromise - T1456 Dynamic-Link Library Injection - T1055.001 Encrypted/Encoded File - T1027.013 Exfiltration Over Alternative Protocol - T1639 Hooking - T1617 Ingress Tool Transfer - T1544 Inhibit System Recovery - T1490 Ip Addresses - T1590.005 Lateral Tool Transfer - T1570 Local Account - T1087.001 Local Account - T1136.001 Local Groups - T1069.001 Lsass Memory - T1003.001 Malicious File - T1204.002 Malvertising - T1583.008 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Match Legitimate Name Or Location - T1036.005 Match Legitimate Name Or Location - T1655.001 Pass The Hash - T1550.002 Powershell - T1059.001 Process Injection - T1631 Python - T1059.006 Remote Desktop Protocol - T1021.001 Safe Mode Boot - T1562.009 Scheduled Task - T1053.005 Server - T1583.004 Server - T1584.004 Service Execution - T1569.002 Smb/Windows Admin Shares - T1021.002 Software - T1592.002 Ssh - T1021.004 Windows Command Shell - T1059.003 Web Protocols - T1071.001 Web Protocols - T1437.001 Winlogon Helper Dll - T1547.004 Tool - T1588.002 Account Manipulation - T1098 Connection Proxy - T1090 Credential Dumping - T1003 Data From Network Shared Drive - T1039 Dll Side-Loading - T1073 Drive-By Compromise - T1189 Exfiltration Over Alternative Protocol - T1048 Hooking - T1179 Remote File Copy - T1105 Masquerading - T1036 Network Share Discovery - T1135 Pass The Hash - T1075 Powershell - T1086 Process Injection - T1055 Remote Desktop Protocol - T1076 Remote System Discovery - T1018 Scheduled Task - T1053 Service Execution - T1035 Winlogon Helper Dll - T1004 Windows Management Instrumentation - T1047 Drive-By Compromise Hooking Masquerading Remote System Discovery
Common Information
Type Value
UUID 8937d4e8-dd18-427c-8626-6ac6645955e0
Fingerprint a428a5dd2d2a85c3
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 30, 2024, 12:45 a.m.
Added to db Sept. 30, 2024, 2:54 a.m.
Last updated Oct. 12, 2024, 1:08 a.m.
Headline Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
Title Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
Detected Hints/Tags/Attributes 192/4/174
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 249 The DFIR Report https://thedfirreport.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 2
version.zip
Details Domain 3
slv.py
Details Domain 2
wo14.py
Details Domain 2
wo12.py
Details Domain 2
com.amazon.csm.csa.prod
Details Domain 81
www.amazon.com
Details Domain 54
www.cloudflare.com
Details Domain 53
hunt.io
Details Domain 2
restic.rest
Details Domain 2
worksliv.py
Details Domain 10
detection.fyi
Details Domain 9
sigmasearchengine.com
Details File 2
version.zip
Details File 190
setup.exe
Details File 6
python311.dll
Details File 65
python.exe
Details File 3
slv.py
Details File 2
wo14.py
Details File 2
wo12.py
Details File 2
c:\windows\adfs\py\updateedge.bat
Details File 2
c:\users\redacted\appdata\local\notepad\upedge.bat
Details File 2
c:\users\redacted\appdata\local\notepad\updateedge.bat
Details File 2
c:\users\redacted\appdata\local\notepad\updateeg.bat
Details File 2
windowstempupdate.exe
Details File 2
updateedge.bat
Details File 1974
cmd.exe
Details File 9
c:\windows\system32\userinit.exe
Details File 203
winlogon.exe
Details File 2
srv.txt
Details File 2
amazon.cs
Details File 2
m.cs
Details File 2
%windir%\syswow64\gpupdate.exe
Details File 2
%windir%\sysnative\gpupdate.exe
Details File 479
ntdll.dll
Details File 679
kernel32.dll
Details File 3
restic.exe
Details File 2
ppp.txt
Details File 3
up.bat
Details File 55
1.bat
Details File 11
psexec64.exe
Details File 3
pc.txt
Details File 2
c:\example.exe
Details File 18
c:\windows\syswow64\cmd.exe
Details File 387
c:\windows\system32\cmd.exe
Details File 2
c:\windows\temp\2-redacted-51.exe
Details File 15
iisreset.exe
Details File 326
vssadmin.exe
Details File 228
wmic.exe
Details File 88
wevtutil.exe
Details File 7
example.exe
Details File 2
worksliv.py
Details File 2
updateeg.bat
Details File 2
2-redacted-51.exe
Details File 2
domain_name.exe
Details File 43
nltest.exe
Details md5 23
72a589da586844d7f0818ce684948eea
Details md5 15
f176ba63b4d68e576b5ba345bec2c7b7
Details md5 2
1329384dfdcfde2228da94e2a042f2b4
Details md5 2
f27a9b7c29960aaf911f2885b40536c2
Details md5 3
19e29534fd49dd27d09234e639c4057e
Details md5 3
f4febc55ea12b31ae17cfb7e614afda8
Details md5 2
d6828e30ab66774a91a96ae93be4ae4c
Details md5 2
DBF5F56998705C37076B6CAE5D0BFB4D
Details md5 2
EB64862F1C8464CA3D03CF0A4AC608F4
Details md5 2
3A4FDBC642A24A240692F9CA70757E9F
Details md5 2
7A4CB8261036F35FD273DA420BF0FD5E
Details md5 2
1BE7FE8E20F8E9FDC6FD6100DCAD38F3
Details md5 2
4232C065029EB52D1B4596A08568E800
Details md5 2
637FB65A1755C4B6DC1E0428E69B634E
Details md5 2
0B1882F719504799B3211BF73DFDC253
Details md5 2
E20FC97E364E859A2FB58D66BC2A1D05
Details md5 2
C737A137B66138371133404C38716741
Details md5 2
7A1E7F652055C812644AD240C41D904A
Details md5 2
E0D1CF0ABD09D7632F79A8259283288D
Details sha1 3
e6ab3c595ac703afd94618d1ca1b8ebce623b21f
Details sha1 3
6f43e6388b64998b7aa7411104b955a8949c4c63
Details sha1 3
794203a4e18f904f0d244c7b3c2f5126b58f6a21
Details sha1 3
9648559769179677c5b58d5619ca8872f5086312
Details sha1 3
c4cde794cf4a68d63617458a60bc8b90d99823ca
Details sha1 3
79818110abd52ba14800cdff39eca3252412b232
Details sha1 3
fba4652b6dbe0948d4dadcebf51737a738ca9e67
Details sha1 3
448892d5607124fdd520f62ff0bc972df801c046
Details sha1 3
f5f56413f81e8f4a941f53e42a90ba1720823f15
Details sha1 3
a3e4fb487400d99e3a9f3523aeaa9af5cf6e128b
Details sha1 3
b39c244c3117f516ce5844b2a843eff1e839207c
Details sha1 3
3a78ce27a7aa16a8230668c644c7df308de6cf33
Details sha256 3
5dc8b08c7e1b11abf2b6b311cd7e411db16a7c3827879c6f93bd0dac7a71d321
Details sha256 3
726f038c13e4c90976811b462e6d21e10e05f7c11e35331d314c546d91fa6d21
Details sha256 3
5f7d438945306bf8a7f35cab0e2acc80cdc9295a57798d8165ef6d8b86fbb38d
Details sha256 3
4ef1009923fc12c2a3127c929e0aa4515c9f4d068737389afb3464c28ccf5925
Details sha256 3
4ee4e1e2cedf59a802c01fae9ccfcfde3e84764c72e7d95b97992addd6edf527
Details sha256 3
3298629de0489c12e451152e787d294753515855dbf1ce80bfcded584a84ac62
Details sha256 3
b3b1ff7e3d1d4f438e40208464cebfb641b434f5bf5cf18b7cec2d189f52c1b6
Details sha256 3
39ec2834494f384028ad17296f70ed6608808084ef403714cfbc1bfbbed263d4
Details sha256 3
9514035fea8000a664799e369ae6d3af6abfe8e5cda23cdafbede83051692e63
Details sha256 3
25172a046821bd04e74c15dc180572288c67fdff474bdb5eb11b76dce1b3dad3
Details sha256 3
5fac60f1e97b6eaae18ebd8b49b912c86233cf77637590f36aa319651582d3c4
Details sha256 3
d15cab3901e9a10af772a0a1bdbf35b357ee121413d4cf542d96819dc4471158
Details IPv4 3
91.92.250.65
Details IPv4 3
91.92.250.60
Details IPv4 4
118.0.0.0
Details IPv4 2
91.92.240.175
Details IPv4 2
91.92.240.194
Details IPv4 2
91.92.241.117
Details IPv4 2
91.92.242.182
Details IPv4 2
91.92.242.39
Details IPv4 2
91.92.242.55
Details IPv4 2
91.92.245.174
Details IPv4 2
91.92.245.175
Details IPv4 2
91.92.247.123
Details IPv4 2
91.92.247.127
Details IPv4 2
91.92.249.110
Details IPv4 2
91.92.250.148
Details IPv4 2
91.92.250.158
Details IPv4 2
91.92.250.66
Details IPv4 2
91.92.251.240
Details IPv4 2
94.156.67.175
Details IPv4 2
94.156.67.180
Details IPv4 2
94.156.67.185
Details IPv4 2
94.156.67.188
Details IPv4 2
141.98.6.195
Details IPv4 2
193.42.33.14
Details IPv4 2
194.180.48.165
Details IPv4 2
194.180.48.42
Details IPv4 2
194.49.94.21
Details IPv4 2
194.49.94.22
Details IPv4 2
185.73.124.238
Details IPv4 3
194.49.94.18
Details IPv4 3
194.169.175.134
Details IPv4 3
195.123.226.84
Details IPv4 3
91.92.245.26
Details MITRE ATT&CK Techniques 99
T1098
Details MITRE ATT&CK Techniques 82
T1070.001
Details MITRE ATT&CK Techniques 411
T1486
Details MITRE ATT&CK Techniques 65
T1039
Details MITRE ATT&CK Techniques 190
T1574.002
Details MITRE ATT&CK Techniques 66
T1069.002
Details MITRE ATT&CK Techniques 115
T1482
Details MITRE ATT&CK Techniques 171
T1189
Details MITRE ATT&CK Techniques 56
T1055.001
Details MITRE ATT&CK Techniques 10
T1027.013
Details MITRE ATT&CK Techniques 84
T1048
Details MITRE ATT&CK Techniques 439
T1105
Details MITRE ATT&CK Techniques 254
T1490
Details MITRE ATT&CK Techniques 108
T1570
Details MITRE ATT&CK Techniques 65
T1087.001
Details MITRE ATT&CK Techniques 29
T1069.001
Details MITRE ATT&CK Techniques 159
T1003.001
Details MITRE ATT&CK Techniques 330
T1204.002
Details MITRE ATT&CK Techniques 324
T1036
Details MITRE ATT&CK Techniques 153
T1036.005
Details MITRE ATT&CK Techniques 163
T1135
Details MITRE ATT&CK Techniques 403
T1059.001
Details MITRE ATT&CK Techniques 414
T1055
Details MITRE ATT&CK Techniques 53
T1059.006
Details MITRE ATT&CK Techniques 151
T1021.001
Details MITRE ATT&CK Techniques 224
T1018
Details MITRE ATT&CK Techniques 24
T1562.009
Details MITRE ATT&CK Techniques 245
T1053.005
Details MITRE ATT&CK Techniques 155
T1569.002
Details MITRE ATT&CK Techniques 126
T1021.002
Details MITRE ATT&CK Techniques 380
T1071.001
Details MITRE ATT&CK Techniques 296
T1059.003
Details MITRE ATT&CK Techniques 294
T1047
Details MITRE ATT&CK Techniques 18
T1547.004
Details Url 5
https://www.amazon.com
Details Url 4
https://www.cloudflare.com
Details Url 2
http://195.123.226.84:8000
Details Windows Registry Key 7
HKLM\software\microsoft\windows
Details Windows Registry Key 3
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Details Windows Registry Key 157
HKLM\SOFTWARE\Microsoft\Windows
Details Windows Registry Key 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\15991160457623399845550968347370640942
Details Windows Registry Key 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\15991160457623399845550968347370640942
Details Windows Registry Key 17
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters