Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 09:06
Static task
static1
Behavioral task
behavioral1
Sample
INV_5678_78390.exe
Resource
win7
General
-
Target
INV_5678_78390.exe
-
Size
805KB
-
MD5
c8cb205521c57333657881084113989a
-
SHA1
9b71480fb738fc0856081f9a356b13e174bb9bd1
-
SHA256
3d59dd3243943e67cd98e96104d36c22925c7df238df3aeb804663893b102969
-
SHA512
6a5d0314e83f8358a984906b646c3bd28a60326d5b347f2ce0659c02be8be065b5bc2cde9eb22a45ab9c1ee93a1704877cb334c0da70359804fd2e2f0943aef2
Malware Config
Extracted
nanocore
1.2.2.0
urualla.duckdns.org:3999
urualla3.duckdns.org:3999
d15035f6-d9d3-4e8b-9141-2ca7d3ee51bb
-
activate_away_mode
true
-
backup_connection_host
urualla3.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-11-15T10:43:13.463487336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3999
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
d15035f6-d9d3-4e8b-9141-2ca7d3ee51bb
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
urualla.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
skype.exedescription pid process target process PID 1444 set thread context of 1632 1444 skype.exe skype.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
skype.exedescription pid process Token: SeDebugPrivilege 1632 skype.exe -
Executes dropped EXE 3 IoCs
Processes:
skype.exeskype.exeskype.exepid process 1444 skype.exe 1632 skype.exe 1828 skype.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
skype.exepid process 1444 skype.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
skype.exepid process 1632 skype.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/1632-4-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/1632-8-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/1632-9-0x0000000000400000-0x000000000047F000-memory.dmp upx -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\startup\skype.exe:ZoneIdentifier notepad.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype.exe.vbs notepad.exe -
Processes:
skype.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA skype.exe -
Suspicious behavior: EnumeratesProcesses 2626 IoCs
Processes:
INV_5678_78390.exeskype.exeskype.exepid process 736 INV_5678_78390.exe 736 INV_5678_78390.exe 1444 skype.exe 1444 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe 1828 skype.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
INV_5678_78390.exenotepad.exeskype.exedescription pid process target process PID 736 wrote to memory of 1332 736 INV_5678_78390.exe notepad.exe PID 736 wrote to memory of 1332 736 INV_5678_78390.exe notepad.exe PID 736 wrote to memory of 1332 736 INV_5678_78390.exe notepad.exe PID 736 wrote to memory of 1332 736 INV_5678_78390.exe notepad.exe PID 736 wrote to memory of 1332 736 INV_5678_78390.exe notepad.exe PID 1332 wrote to memory of 1444 1332 notepad.exe skype.exe PID 1332 wrote to memory of 1444 1332 notepad.exe skype.exe PID 1332 wrote to memory of 1444 1332 notepad.exe skype.exe PID 1444 wrote to memory of 1632 1444 skype.exe skype.exe PID 1444 wrote to memory of 1632 1444 skype.exe skype.exe PID 1444 wrote to memory of 1632 1444 skype.exe skype.exe PID 1444 wrote to memory of 1828 1444 skype.exe skype.exe PID 1444 wrote to memory of 1828 1444 skype.exe skype.exe PID 1444 wrote to memory of 1828 1444 skype.exe skype.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV_5678_78390.exe"C:\Users\Admin\AppData\Local\Temp\INV_5678_78390.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- NTFS ADS
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Roaming\startup\skype.exe"C:\Users\Admin\AppData\Roaming\startup\skype.exe"3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Roaming\startup\skype.exe"C:\Users\Admin\AppData\Roaming\startup\skype.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
PID:1632 -
C:\Users\Admin\AppData\Roaming\startup\skype.exe"C:\Users\Admin\AppData\Roaming\startup\skype.exe" 2 1632 1222184⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1828