Analysis
- max time kernel
150s - max time network
132s - platform
windows7_x64 - resource
win7 - submitted
17/08/2020, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE COPY.pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target INVOICE COPY.pdf.exe
- Size 1.1MB
- Sample200817-jfl3rtckjn
- SHA256 1ca9978db84d8cad7f6a8f838e106799352c386cfa3aee2bbefa195e7fabe166
- MD5 be48d1528b84a01897cf4bb91b0cc0de
- SHA1 c28a15dd476e7bc51009bd3bbfd8dcb38a908dad
- SHA512 a70cb02f76700793c72456c15135de8c371d344257a238ca3f96f4eb0b22f097bcfd5ff73a7cbc8fced1ce7619caa645cb5be87a82f51a1c7bd12c63a534a7af
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
bbshp.giize.com:9301
-
niiarmah.duckdns.org:9301
Mutex
-
00be1b48-1e19-4199-9165-043905f470c6
Attributes
-
activate_away_mode
true
-
backup_connection_host
niiarmah.duckdns.org
-
backup_dns_server
niiarmah.duckdns.org
-
buffer_size
65535
-
build_time
2020-05-29T02:43:50.204478436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9301
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
00be1b48-1e19-4199-9165-043905f470c6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bbshp.giize.com
-
primary_dns_server
bbshp.giize.com
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1328 akqwnvojv.pif 292 RegSvcs.exe - Loads dropped DLL 5 IoCs
pid Process 1124 INVOICE COPY.pdf.exe 1124 INVOICE COPY.pdf.exe 1124 INVOICE COPY.pdf.exe 1124 INVOICE COPY.pdf.exe 1328 akqwnvojv.pif - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run akqwnvojv.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\46173289\\AKQWNV~1.PIF C:\\Users\\Admin\\46173289\\OPCSWG~1.WBD" akqwnvojv.pif -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1328 set thread context of 292 1328 akqwnvojv.pif 25 - Suspicious behavior: EnumeratesProcesses 149 IoCs
pid Process 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 292 RegSvcs.exe 292 RegSvcs.exe 1328 akqwnvojv.pif 292 RegSvcs.exe 292 RegSvcs.exe 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 292 RegSvcs.exe 292 RegSvcs.exe 1328 akqwnvojv.pif 1328 akqwnvojv.pif 292 RegSvcs.exe 292 RegSvcs.exe 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif 1328 akqwnvojv.pif - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 292 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 292 RegSvcs.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1328 1124 INVOICE COPY.pdf.exe 24 PID 1124 wrote to memory of 1328 1124 INVOICE COPY.pdf.exe 24 PID 1124 wrote to memory of 1328 1124 INVOICE COPY.pdf.exe 24 PID 1124 wrote to memory of 1328 1124 INVOICE COPY.pdf.exe 24 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25 PID 1328 wrote to memory of 292 1328 akqwnvojv.pif 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE COPY.pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\46173289\akqwnvojv.pif"C:\Users\Admin\46173289\akqwnvojv.pif" opcswgxwww.wbd2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:292
-
-