Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 06:51
Static task
static1
Behavioral task
behavioral1
Sample
DMX_Asia_Pte,pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
DMX_Asia_Pte,pdf.exe
Resource
win10v200430
General
-
Target
DMX_Asia_Pte,pdf.exe
-
Size
436KB
-
MD5
afd14de232371717b96865c8447ae630
-
SHA1
8ae425001b9bc2c29201a4d9e31a63d11e85f3b1
-
SHA256
bfbb3994c6e4d6ae2d30921757d039e004d1f5274c314765e641bf111bc0dec7
-
SHA512
1f81327ac2be1c21e6276400935449f655c59727413007af319cf69848c4f9112f1545fa8538d2bf8b6a2c9d1149ca4299dc5fd8820172629b4b516dd032d2d9
Malware Config
Extracted
nanocore
1.2.2.0
billionaire.ddns.net:3734
24d8b675-ce49-4a1b-a4a3-dc5d84e97d70
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-25T16:42:00.435974836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3734
-
default_group
Billion
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
24d8b675-ce49-4a1b-a4a3-dc5d84e97d70
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
billionaire.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
DMX_Asia_Pte,pdf.exeMSBuild.exedescription pid process target process PID 1156 wrote to memory of 1820 1156 DMX_Asia_Pte,pdf.exe schtasks.exe PID 1156 wrote to memory of 1820 1156 DMX_Asia_Pte,pdf.exe schtasks.exe PID 1156 wrote to memory of 1820 1156 DMX_Asia_Pte,pdf.exe schtasks.exe PID 1156 wrote to memory of 1820 1156 DMX_Asia_Pte,pdf.exe schtasks.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1156 wrote to memory of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe PID 1884 wrote to memory of 1912 1884 MSBuild.exe schtasks.exe PID 1884 wrote to memory of 1912 1884 MSBuild.exe schtasks.exe PID 1884 wrote to memory of 1912 1884 MSBuild.exe schtasks.exe PID 1884 wrote to memory of 1912 1884 MSBuild.exe schtasks.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DMX_Asia_Pte,pdf.exedescription pid process target process PID 1156 set thread context of 1884 1156 DMX_Asia_Pte,pdf.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1884 MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 1884 MSBuild.exe 1884 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1884 MSBuild.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1820 schtasks.exe 1912 schtasks.exe -
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DMX_Asia_Pte,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DMX_Asia_Pte,pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GmmLIoHLlkHN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp892B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8D7F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp892B.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmp8D7F.tmp
-
memory/1156-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1820-2-0x0000000000000000-mapping.dmp
-
memory/1884-4-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1884-5-0x000000000041E792-mapping.dmp
-
memory/1884-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1884-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1912-8-0x0000000000000000-mapping.dmp