Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 07:26
Static task
static1
Behavioral task
behavioral1
Sample
nass.exe
Resource
win7
General
-
Target
nass.exe
-
Size
710KB
-
MD5
9430ffb97fd0940e0c6fcaa11d409202
-
SHA1
17b3a43c427429aa84624ab6a7f21c3621cdc464
-
SHA256
f1fddc0cfd9632772ba10b059d83a1bb34b01a81766e61804bc39ca3898c5211
-
SHA512
eeadcb7f802d07d17a31648b23b732beaae11b5a9e35853af47e6d8f3d5f0f84ef3ceb621cf6e236bc1e5e6b6f18ce855446494ed548ceeeb26d9017b91d6b40
Malware Config
Extracted
nanocore
1.2.2.0
mogs20.hopto.org:1085
185.244.30.251:1085
1c8e1b25-da1c-4b7f-872b-7991ecf830f7
-
activate_away_mode
true
-
backup_connection_host
185.244.30.251
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-26T22:47:50.934251036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1085
-
default_group
ANGEL RAPHAEL
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1c8e1b25-da1c-4b7f-872b-7991ecf830f7
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
mogs20.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 6 IoCs
Processes:
nass.exenass.exenass.exenass.exenass.exenass.exedescription pid process target process PID 1152 set thread context of 1060 1152 nass.exe RegAsm.exe PID 1816 set thread context of 1884 1816 nass.exe RegAsm.exe PID 1912 set thread context of 1972 1912 nass.exe RegAsm.exe PID 1348 set thread context of 1852 1348 nass.exe RegAsm.exe PID 1572 set thread context of 1676 1572 nass.exe RegAsm.exe PID 864 set thread context of 1344 864 nass.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
nass.exenass.exenass.exenass.exenass.exeRegAsm.exenass.exedescription pid process Token: SeDebugPrivilege 1152 nass.exe Token: SeDebugPrivilege 1816 nass.exe Token: SeDebugPrivilege 1912 nass.exe Token: SeDebugPrivilege 1348 nass.exe Token: SeDebugPrivilege 1572 nass.exe Token: SeDebugPrivilege 1060 RegAsm.exe Token: SeDebugPrivilege 864 nass.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1060 RegAsm.exe -
Adds Run entry to start application 2 TTPs 6 IoCs
Processes:
nass.exenass.exenass.exenass.exenass.exenass.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nass.exe" nass.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nass.exe" nass.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nass.exe" nass.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nass.exe" nass.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nass.exe" nass.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nass.exe" nass.exe -
Suspicious use of WriteProcessMemory 93 IoCs
Processes:
nass.exenass.exenass.exenass.exenass.exedescription pid process target process PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1056 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1060 1152 nass.exe RegAsm.exe PID 1152 wrote to memory of 1816 1152 nass.exe nass.exe PID 1152 wrote to memory of 1816 1152 nass.exe nass.exe PID 1152 wrote to memory of 1816 1152 nass.exe nass.exe PID 1152 wrote to memory of 1816 1152 nass.exe nass.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1784 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1884 1816 nass.exe RegAsm.exe PID 1816 wrote to memory of 1912 1816 nass.exe nass.exe PID 1816 wrote to memory of 1912 1816 nass.exe nass.exe PID 1816 wrote to memory of 1912 1816 nass.exe nass.exe PID 1816 wrote to memory of 1912 1816 nass.exe nass.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1972 1912 nass.exe RegAsm.exe PID 1912 wrote to memory of 1348 1912 nass.exe nass.exe PID 1912 wrote to memory of 1348 1912 nass.exe nass.exe PID 1912 wrote to memory of 1348 1912 nass.exe nass.exe PID 1912 wrote to memory of 1348 1912 nass.exe nass.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1852 1348 nass.exe RegAsm.exe PID 1348 wrote to memory of 1572 1348 nass.exe nass.exe PID 1348 wrote to memory of 1572 1348 nass.exe nass.exe PID 1348 wrote to memory of 1572 1348 nass.exe nass.exe PID 1348 wrote to memory of 1572 1348 nass.exe nass.exe PID 1572 wrote to memory of 1676 1572 nass.exe RegAsm.exe PID 1572 wrote to memory of 1676 1572 nass.exe RegAsm.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
nass.exenass.exenass.exenass.exenass.exenass.exepid process 1152 nass.exe 1152 nass.exe 1816 nass.exe 1816 nass.exe 1912 nass.exe 1348 nass.exe 1572 nass.exe 864 nass.exe 864 nass.exe -
Suspicious behavior: EnumeratesProcesses 628 IoCs
Processes:
nass.exepid process 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe 1152 nass.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\nass.exe"C:\Users\Admin\AppData\Local\Temp\nass.exe"7⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-29-0x0000000000000000-mapping.dmp
-
memory/864-24-0x0000000000000000-mapping.dmp
-
memory/1060-1-0x000000000041E792-mapping.dmp
-
memory/1060-2-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1060-3-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1060-0-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1344-26-0x000000000041E792-mapping.dmp
-
memory/1348-14-0x0000000000000000-mapping.dmp
-
memory/1572-19-0x0000000000000000-mapping.dmp
-
memory/1676-21-0x000000000041E792-mapping.dmp
-
memory/1816-4-0x0000000000000000-mapping.dmp
-
memory/1852-16-0x000000000041E792-mapping.dmp
-
memory/1884-6-0x000000000041E792-mapping.dmp
-
memory/1912-9-0x0000000000000000-mapping.dmp
-
memory/1972-11-0x000000000041E792-mapping.dmp