Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 06:57
Static task
static1
Behavioral task
behavioral1
Sample
STMPO3683HK.exe
Resource
win7
General
-
Target
STMPO3683HK.exe
-
Size
715KB
-
MD5
76a8f2eb76dce33384b6eae299b861cd
-
SHA1
c9028f427d3bfd2efe4b08989ea73be739a6d290
-
SHA256
9eb1cd61e77d7133bd5252c9c7574d4171ba60c856dbedd15754c5b0e3c827b4
-
SHA512
d4bc7ebfe33ac92f003d5800ff9a391e0af2973dff565c1f0806ac6ed37c8b6c138b1294e079909dbfd5294d61099ade4749a7774fe246747a174f4bf300e1b1
Malware Config
Extracted
nanocore
1.2.2.0
darlingtondc.hopto.org:1905
185.165.153.17:1905
9ca847a1-73ff-4b6f-bbac-e86d31071270
-
activate_away_mode
true
-
backup_connection_host
185.165.153.17
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-19T00:49:06.806996136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1905
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9ca847a1-73ff-4b6f-bbac-e86d31071270
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
darlingtondc.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
STMPO3683HK.exepid process 1100 STMPO3683HK.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
STMPO3683HK.exedescription pid process target process PID 1100 set thread context of 1256 1100 STMPO3683HK.exe STMPO3683HK.exe -
Processes:
STMPO3683HK.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA STMPO3683HK.exe -
Suspicious behavior: EnumeratesProcesses 1375 IoCs
Processes:
STMPO3683HK.exeSTMPO3683HK.exeSTMPO3683HK.exepid process 1100 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1256 STMPO3683HK.exe 1256 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe 1116 STMPO3683HK.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
STMPO3683HK.exedescription pid process target process PID 1100 wrote to memory of 1256 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1256 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1256 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1256 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1116 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1116 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1116 1100 STMPO3683HK.exe STMPO3683HK.exe PID 1100 wrote to memory of 1116 1100 STMPO3683HK.exe STMPO3683HK.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
STMPO3683HK.exedescription pid process Token: SeDebugPrivilege 1256 STMPO3683HK.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
STMPO3683HK.exepid process 1256 STMPO3683HK.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral1/memory/1256-0-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral1/memory/1256-2-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral1/memory/1256-3-0x0000000000400000-0x000000000047F000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe" 2 1256 738822⤵
- Suspicious behavior: EnumeratesProcesses
PID:1116