Analysis
- max time kernel
153s - max time network
144s - platform
windows7_x64 - resource
win7v200722 - submitted
29/07/2020, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe
- Size 3.9MB
- Sample200729-6pb74tfjsa
- SHA256 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4
- MD5 91027dd7468e8836631a8793d73164fd
- SHA1 02482738aebf223e424f34dfe9eefc55671caf65
- SHA512 4e6657921dad88c4f51e70809ccc6d661c7c545084f8a09591625a783fb6859c1b9db820f958cb62b2e1a333d43e326d8922fd6103bea19c7645058156e07f8a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
KUTAS54645-53485.portmap.host:37458
Mutex
-
c7acd0a5-aac9-4a2e-8efa-4df3b342a8d7
Attributes
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-09T05:47:35.262147836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
37458
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c7acd0a5-aac9-4a2e-8efa-4df3b342a8d7
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
KUTAS54645-53485.portmap.host
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1848 tmpC3F9.tmp.exe - JavaScript code in executable 5 IoCs
resource yara_rule behavioral1/files/0x0005000000013190-0.dat js behavioral1/files/0x0005000000013190-2.dat js behavioral1/files/0x0005000000013190-5.dat js behavioral1/files/0x0005000000013190-6.dat js behavioral1/files/0x0005000000013190-11.dat js -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA crypted.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1088 wrote to memory of 1096 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 24 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1096 wrote to memory of 1036 1096 CDS.exe 25 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1684 1036 crypted.exe 26 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1036 wrote to memory of 1776 1036 crypted.exe 27 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1636 1776 WindowsDefenderUpdater.exe 28 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1776 wrote to memory of 1848 1776 WindowsDefenderUpdater.exe 29 PID 1848 wrote to memory of 1912 1848 tmpC3F9.tmp.exe 30 PID 1848 wrote to memory of 1912 1848 tmpC3F9.tmp.exe 30 PID 1848 wrote to memory of 1912 1848 tmpC3F9.tmp.exe 30 PID 1848 wrote to memory of 1912 1848 tmpC3F9.tmp.exe 30 PID 1848 wrote to memory of 1912 1848 tmpC3F9.tmp.exe 30 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1912 powershell.exe Token: SeDebugPrivilege 1684 crypted.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1096 CDS.exe 1096 CDS.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1036 set thread context of 1684 1036 crypted.exe 26 PID 1776 set thread context of 1636 1776 WindowsDefenderUpdater.exe 28 - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1912 powershell.exe 1912 powershell.exe 1684 crypted.exe 1684 crypted.exe 1684 crypted.exe 1096 CDS.exe 1096 CDS.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1684 crypted.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdater.exe = "C:\\ProgramData\\WindowsDefenderUpdater.exe" crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Temp\\Chrome.exe" powershell.exe - Loads dropped DLL 16 IoCs
pid Process 1088 b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe 1096 CDS.exe 1096 CDS.exe 1096 CDS.exe 1096 CDS.exe 1096 CDS.exe 1096 CDS.exe 1096 CDS.exe 1036 crypted.exe 1036 crypted.exe 1684 crypted.exe 1036 crypted.exe 1776 WindowsDefenderUpdater.exe 1776 WindowsDefenderUpdater.exe 1636 WindowsDefenderUpdater.exe 1776 WindowsDefenderUpdater.exe - Executes dropped EXE 6 IoCs
pid Process 1096 CDS.exe 1036 crypted.exe 1684 crypted.exe 1776 WindowsDefenderUpdater.exe 1636 WindowsDefenderUpdater.exe 1848 tmpC3F9.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe"C:\Users\Admin\AppData\Local\Temp\b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run key to start application
- Loads dropped DLL
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"4⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
- Executes dropped EXE
PID:1684
-
-
C:\ProgramData\WindowsDefenderUpdater.exe"C:\ProgramData\WindowsDefenderUpdater.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Loads dropped DLL
- Executes dropped EXE
PID:1776 -
C:\ProgramData\WindowsDefenderUpdater.exe"C:\ProgramData\WindowsDefenderUpdater.exe"5⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1636
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC3F9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC3F9.tmp.exe"5⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Chrome.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Chrome.exe' -Value '"C:\Users\Admin\AppData\Roaming\Temp\Chrome.exe"' -PropertyType 'String'6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:1912
-
-
-
-
-