Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 07:10
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7
General
-
Target
RFQ.exe
-
Size
744KB
-
MD5
32e1d4c85781d7fbe62d8f93aa5bf792
-
SHA1
86f00a66314b03734bd741d51b78670c756eb794
-
SHA256
6343bc22fcb1a909e908ca7c0fa90d34e09f669dbd72a69e75ff8af7a9d217eb
-
SHA512
7edbc73c739b237d37f911b75051f841bea9b7a7f21c757b8c6e1215c7c443c2acf4ce0c097a874dd4466405571e0c6025661f421b0bc083fb0120080b6229c4
Malware Config
Extracted
nanocore
1.2.2.0
185.165.153.26:1985
2276abda-5081-40bb-9a10-f4ca8116bc08
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-19T23:28:11.122410736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
1985
-
default_group
Xmen
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
2276abda-5081-40bb-9a10-f4ca8116bc08
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.165.153.26
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 316 schtasks.exe 1112 schtasks.exe 1528 schtasks.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\WAN Subsystem\wanss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\WAN Subsystem\wanss.exe RegSvcs.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
RFQ.exeRegSvcs.exedescription pid process target process PID 1124 wrote to memory of 316 1124 RFQ.exe schtasks.exe PID 1124 wrote to memory of 316 1124 RFQ.exe schtasks.exe PID 1124 wrote to memory of 316 1124 RFQ.exe schtasks.exe PID 1124 wrote to memory of 316 1124 RFQ.exe schtasks.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 908 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 644 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 1124 wrote to memory of 776 1124 RFQ.exe RegSvcs.exe PID 776 wrote to memory of 1112 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1112 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1112 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1112 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1528 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1528 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1528 776 RegSvcs.exe schtasks.exe PID 776 wrote to memory of 1528 776 RegSvcs.exe schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1124 RFQ.exe Token: SeDebugPrivilege 776 RegSvcs.exe Token: SeDebugPrivilege 776 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 776 RegSvcs.exe -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Subsystem = "C:\\Program Files (x86)\\WAN Subsystem\\wanss.exe" RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
RFQ.exeRegSvcs.exepid process 1124 RFQ.exe 1124 RFQ.exe 1124 RFQ.exe 776 RegSvcs.exe 776 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ.exedescription pid process target process PID 1124 set thread context of 776 1124 RFQ.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KBKGCm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA015.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA4B7.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA534.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA015.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmpA4B7.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmpA534.tmp
-
memory/316-0-0x0000000000000000-mapping.dmp
-
memory/776-2-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/776-3-0x000000000041E792-mapping.dmp
-
memory/776-4-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/776-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1112-6-0x0000000000000000-mapping.dmp
-
memory/1528-8-0x0000000000000000-mapping.dmp