Analysis
-
max time kernel
69s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-11-2020 06:53
Static task
static1
Behavioral task
behavioral1
Sample
New PO 64739 (UK).exe
Resource
win7v20201028
General
-
Target
New PO 64739 (UK).exe
-
Size
915KB
-
MD5
b6babb0d3661cd172c93c496dc4c1db1
-
SHA1
de2db850207d77611f557a060681f2c2a19ae1ef
-
SHA256
bca89f6ecbf4dfde0cc003b96f907ae1ab9b33a64650836d547d07291a059e86
-
SHA512
45dce5171772db72bf71fc72dab6feda73995e7009f6b0bb74b2f25d6a5e23284c06c167505d56c79c6334a6e14e2b44b3117a4207f4396d4f71f01b1381ce91
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.207:2121
annapro.linkpc.net.:2121
34118051-8385-43c4-bed1-aa9e16db604f
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net.
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-08-14T02:17:37.803675836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2121
-
default_group
hip
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
34118051-8385-43c4-bed1-aa9e16db604f
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.140.53.207
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
New PO 64739 (UK).exedescription pid process target process PID 1664 set thread context of 548 1664 New PO 64739 (UK).exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
New PO 64739 (UK).exeMSBuild.exepid process 1664 New PO 64739 (UK).exe 1664 New PO 64739 (UK).exe 1664 New PO 64739 (UK).exe 1664 New PO 64739 (UK).exe 548 MSBuild.exe 548 MSBuild.exe 548 MSBuild.exe 548 MSBuild.exe 548 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 548 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New PO 64739 (UK).exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1664 New PO 64739 (UK).exe Token: SeDebugPrivilege 548 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
New PO 64739 (UK).exedescription pid process target process PID 1664 wrote to memory of 1792 1664 New PO 64739 (UK).exe schtasks.exe PID 1664 wrote to memory of 1792 1664 New PO 64739 (UK).exe schtasks.exe PID 1664 wrote to memory of 1792 1664 New PO 64739 (UK).exe schtasks.exe PID 1664 wrote to memory of 1792 1664 New PO 64739 (UK).exe schtasks.exe PID 1664 wrote to memory of 768 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 768 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 768 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 768 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe PID 1664 wrote to memory of 548 1664 New PO 64739 (UK).exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New PO 64739 (UK).exe"C:\Users\Admin\AppData\Local\Temp\New PO 64739 (UK).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TqGgKBQek" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20CA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp20CA.tmpMD5
78e1f89ea5db4c2686f3613e06f3d067
SHA17a619b140e76c02c08bbf24214902c80979f2a2a
SHA2563cb4aa1a71dbe2592aa076152d47c6f9ffdfa45de2242f7fca63c958f738ae2c
SHA51205f65e6b16899addb10b691329dc79503014401a66b67266c777b3bac8a206dbb8fe113d6592aef5ca1ece0c2ff0f16d83578dc9e1be8376a9fe77f979857025
-
memory/548-15-0x0000000000360000-0x0000000000365000-memory.dmpFilesize
20KB
-
memory/548-23-0x0000000000950000-0x0000000000956000-memory.dmpFilesize
24KB
-
memory/548-17-0x0000000000390000-0x0000000000393000-memory.dmpFilesize
12KB
-
memory/548-18-0x0000000000610000-0x000000000061D000-memory.dmpFilesize
52KB
-
memory/548-16-0x0000000000370000-0x0000000000389000-memory.dmpFilesize
100KB
-
memory/548-28-0x00000000022C0000-0x00000000022E9000-memory.dmpFilesize
164KB
-
memory/548-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/548-9-0x000000000041E792-mapping.dmp
-
memory/548-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/548-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/548-12-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/548-27-0x0000000000BE0000-0x0000000000BEA000-memory.dmpFilesize
40KB
-
memory/548-29-0x0000000000C00000-0x0000000000C0F000-memory.dmpFilesize
60KB
-
memory/548-26-0x0000000000BD0000-0x0000000000BDF000-memory.dmpFilesize
60KB
-
memory/548-25-0x0000000000BC0000-0x0000000000BC9000-memory.dmpFilesize
36KB
-
memory/548-19-0x0000000000620000-0x0000000000635000-memory.dmpFilesize
84KB
-
memory/548-20-0x0000000000690000-0x0000000000696000-memory.dmpFilesize
24KB
-
memory/548-21-0x00000000007E0000-0x00000000007EC000-memory.dmpFilesize
48KB
-
memory/548-22-0x0000000000940000-0x0000000000947000-memory.dmpFilesize
28KB
-
memory/548-24-0x0000000000B30000-0x0000000000B3D000-memory.dmpFilesize
52KB
-
memory/1664-3-0x0000000000570000-0x0000000000583000-memory.dmpFilesize
76KB
-
memory/1664-5-0x0000000000A80000-0x0000000000AB5000-memory.dmpFilesize
212KB
-
memory/1664-4-0x0000000005840000-0x00000000058AA000-memory.dmpFilesize
424KB
-
memory/1664-0-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/1664-1-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/1792-6-0x0000000000000000-mapping.dmp