Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 18:35
Static task
static1
Behavioral task
behavioral1
Sample
Transaction_Details.exe
Resource
win7
Behavioral task
behavioral2
Sample
Transaction_Details.exe
Resource
win10v200430
General
-
Target
Transaction_Details.exe
-
Size
436KB
-
MD5
5257be13506bef5fadcc0794131afc65
-
SHA1
220e7a1680a4e0773430a7691448b556ebad437a
-
SHA256
244e2f212245708bd757b50107c8d221e842a683c258f16b744be653fde53c73
-
SHA512
1e24bbffb4cae58f1a2aa423d80d00723623ef1d74e9987069366606cc78d6fc5e4a39be112a5f491f9e2211ffae5cc072a41a22787b674326dcd5e8fbe6357b
Malware Config
Extracted
nanocore
1.2.2.0
45.77.147.196:24980
ufok.duckdns.org:24980
b4474f1d-f922-4f98-b638-5c6cbc8c6590
-
activate_away_mode
true
-
backup_connection_host
ufok.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-19T16:57:17.983830036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
24980
-
default_group
men
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b4474f1d-f922-4f98-b638-5c6cbc8c6590
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
45.77.147.196
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
Transaction_Details.exeRegSvcs.exeelurA.czg.exeelurA.czg.exedescription pid process target process PID 1420 wrote to memory of 784 1420 Transaction_Details.exe schtasks.exe PID 1420 wrote to memory of 784 1420 Transaction_Details.exe schtasks.exe PID 1420 wrote to memory of 784 1420 Transaction_Details.exe schtasks.exe PID 1420 wrote to memory of 784 1420 Transaction_Details.exe schtasks.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1080 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1420 wrote to memory of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1076 wrote to memory of 1532 1076 RegSvcs.exe cmd.exe PID 1076 wrote to memory of 1532 1076 RegSvcs.exe cmd.exe PID 1076 wrote to memory of 1532 1076 RegSvcs.exe cmd.exe PID 1076 wrote to memory of 1532 1076 RegSvcs.exe cmd.exe PID 1076 wrote to memory of 1532 1076 RegSvcs.exe cmd.exe PID 1076 wrote to memory of 1532 1076 RegSvcs.exe cmd.exe PID 1076 wrote to memory of 1112 1076 RegSvcs.exe elurA.czg.exe PID 1076 wrote to memory of 1112 1076 RegSvcs.exe elurA.czg.exe PID 1076 wrote to memory of 1112 1076 RegSvcs.exe elurA.czg.exe PID 1076 wrote to memory of 1112 1076 RegSvcs.exe elurA.czg.exe PID 1112 wrote to memory of 1048 1112 elurA.czg.exe schtasks.exe PID 1112 wrote to memory of 1048 1112 elurA.czg.exe schtasks.exe PID 1112 wrote to memory of 1048 1112 elurA.czg.exe schtasks.exe PID 1112 wrote to memory of 1048 1112 elurA.czg.exe schtasks.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 1112 wrote to memory of 596 1112 elurA.czg.exe elurA.czg.exe PID 596 wrote to memory of 932 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 932 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 932 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 932 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 896 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 896 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 896 596 elurA.czg.exe schtasks.exe PID 596 wrote to memory of 896 596 elurA.czg.exe schtasks.exe PID 1076 wrote to memory of 1640 1076 RegSvcs.exe pCzEvwf.y.exe PID 1076 wrote to memory of 1640 1076 RegSvcs.exe pCzEvwf.y.exe PID 1076 wrote to memory of 1640 1076 RegSvcs.exe pCzEvwf.y.exe PID 1076 wrote to memory of 1640 1076 RegSvcs.exe pCzEvwf.y.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
elurA.czg.exepid process 596 elurA.czg.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 784 schtasks.exe 1048 schtasks.exe 932 schtasks.exe 896 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Transaction_Details.exeelurA.czg.exedescription pid process Token: SeDebugPrivilege 1420 Transaction_Details.exe Token: SeDebugPrivilege 596 elurA.czg.exe -
Loads dropped DLL 2 IoCs
Processes:
RegSvcs.exepid process 1076 RegSvcs.exe 1076 RegSvcs.exe -
Drops file in Program Files directory 4 IoCs
Processes:
RegSvcs.exeelurA.czg.exedescription ioc process File opened for modification C:\Program Files\Microsoft DN1\sqlmap.dll RegSvcs.exe File created C:\Program Files (x86)\WAN Subsystem\wanss.exe elurA.czg.exe File opened for modification C:\Program Files (x86)\WAN Subsystem\wanss.exe elurA.czg.exe File created C:\Program Files\Microsoft DN1\sqlmap.dll RegSvcs.exe -
Modifies WinLogon 2 TTPs 4 IoCs
Processes:
RegSvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts RegSvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\HniEcAz = "0" RegSvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\vbxdmBu = "0" RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Transaction_Details.exeelurA.czg.exepid process 1420 Transaction_Details.exe 596 elurA.czg.exe 596 elurA.czg.exe 596 elurA.czg.exe 596 elurA.czg.exe 596 elurA.czg.exe 596 elurA.czg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 1076 RegSvcs.exe 1076 RegSvcs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Transaction_Details.exeelurA.czg.exedescription pid process target process PID 1420 set thread context of 1076 1420 Transaction_Details.exe RegSvcs.exe PID 1112 set thread context of 596 1112 elurA.czg.exe elurA.czg.exe -
Executes dropped EXE 3 IoCs
Processes:
elurA.czg.exeelurA.czg.exepCzEvwf.y.exepid process 1112 elurA.czg.exe 596 elurA.czg.exe 1640 pCzEvwf.y.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
elurA.czg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Subsystem = "C:\\Program Files (x86)\\WAN Subsystem\\wanss.exe" elurA.czg.exe -
Processes:
elurA.czg.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA elurA.czg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transaction_Details.exe"C:\Users\Admin\AppData\Local\Temp\Transaction_Details.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1420 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bzBgboNvDgFI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD1F.tmp"2⤵
- Creates scheduled task(s)
PID:784 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:1080
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
PID:1076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1532
-
C:\Users\Admin\AppData\Roaming\elurA.czg.exe"C:\Users\Admin\AppData\Roaming\elurA.czg.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1112 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wriKqTsY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp112F.tmp"4⤵
- Creates scheduled task(s)
PID:1048 -
C:\Users\Admin\AppData\Roaming\elurA.czg.exe"{path}"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Adds Run entry to start application
- Checks whether UAC is enabled
PID:596 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp13CE.tmp"5⤵
- Creates scheduled task(s)
PID:932 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp147A.tmp"5⤵
- Creates scheduled task(s)
PID:896 -
C:\Users\Admin\AppData\Roaming\pCzEvwf.y.exe"C:\Users\Admin\AppData\Roaming\pCzEvwf.y.exe"3⤵
- Executes dropped EXE
PID:1640