Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 16:49
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.exe
Resource
win7
General
-
Target
Invoice.exe
-
Size
315KB
-
MD5
4ba03c618eccb7673a226395511dea83
-
SHA1
c750895954a1fab95f6704a9c3c3e88b0eee7152
-
SHA256
2f003ca84db5f82fcf36040f7d97baae64e0582e830c8c1cea65c32c3d5b21d5
-
SHA512
9795a860d1d5522c89a458d1d2e8b7682cebe7c1ce5b13871565b813334bc108850581103f8f07201d62a30596b5e0451cbfc91a13c41b26155e65583be4fbe6
Malware Config
Extracted
nanocore
1.2.2.0
5.9.145.244:50572
206.123.141.99:50572
4e576054-870a-4bf5-a92e-d5fb537dabde
-
activate_away_mode
true
-
backup_connection_host
206.123.141.99
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-06T11:52:34.476422736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
50572
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4e576054-870a-4bf5-a92e-d5fb537dabde
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
5.9.145.244
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Invoice.exedescription pid process target process PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Invoice.exe RegAsm.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Invoice.exepid process 1464 Invoice.exe 1464 Invoice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoice.exedescription pid process target process PID 1464 set thread context of 904 1464 Invoice.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 904 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 904 RegAsm.exe 904 RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 904 RegAsm.exe -
Drops startup file 1 IoCs
Processes:
Invoice.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe Invoice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-0-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/904-1-0x000000000041E792-mapping.dmp
-
memory/904-2-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/904-3-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB