Analysis
-
max time kernel
60s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-11-2020 06:53
Static task
static1
Behavioral task
behavioral1
Sample
New PO 64739 (UK).exe
Resource
win7v20201028
General
-
Target
New PO 64739 (UK).exe
-
Size
915KB
-
MD5
b6babb0d3661cd172c93c496dc4c1db1
-
SHA1
de2db850207d77611f557a060681f2c2a19ae1ef
-
SHA256
bca89f6ecbf4dfde0cc003b96f907ae1ab9b33a64650836d547d07291a059e86
-
SHA512
45dce5171772db72bf71fc72dab6feda73995e7009f6b0bb74b2f25d6a5e23284c06c167505d56c79c6334a6e14e2b44b3117a4207f4396d4f71f01b1381ce91
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.207:2121
annapro.linkpc.net.:2121
34118051-8385-43c4-bed1-aa9e16db604f
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net.
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-08-14T02:17:37.803675836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2121
-
default_group
hip
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
34118051-8385-43c4-bed1-aa9e16db604f
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.140.53.207
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
New PO 64739 (UK).exedescription pid process target process PID 3980 set thread context of 4068 3980 New PO 64739 (UK).exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
New PO 64739 (UK).exeMSBuild.exepid process 3980 New PO 64739 (UK).exe 3980 New PO 64739 (UK).exe 3980 New PO 64739 (UK).exe 3980 New PO 64739 (UK).exe 3980 New PO 64739 (UK).exe 3980 New PO 64739 (UK).exe 4068 MSBuild.exe 4068 MSBuild.exe 4068 MSBuild.exe 4068 MSBuild.exe 4068 MSBuild.exe 4068 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 4068 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New PO 64739 (UK).exeMSBuild.exedescription pid process Token: SeDebugPrivilege 3980 New PO 64739 (UK).exe Token: SeDebugPrivilege 4068 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
New PO 64739 (UK).exedescription pid process target process PID 3980 wrote to memory of 4076 3980 New PO 64739 (UK).exe schtasks.exe PID 3980 wrote to memory of 4076 3980 New PO 64739 (UK).exe schtasks.exe PID 3980 wrote to memory of 4076 3980 New PO 64739 (UK).exe schtasks.exe PID 3980 wrote to memory of 4092 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4092 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4092 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe PID 3980 wrote to memory of 4068 3980 New PO 64739 (UK).exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New PO 64739 (UK).exe"C:\Users\Admin\AppData\Local\Temp\New PO 64739 (UK).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TqGgKBQek" /XML "C:\Users\Admin\AppData\Local\Temp\tmp158.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp158.tmpMD5
4ce3d2fdcbeb33d1d18d1be54142d87c
SHA1453a773951ffc1829fd216757785b9dc6e5dd651
SHA256d8cc45456e4ff43af7475eb33c252fc323a2ea8f64384d0b1f241016b9b968da
SHA512d682f0a4832fc02840dffc6e740700028e51ec5f90ad55ebec6f666ff9db267ec2d7780fc53fa7a2e7af46ee9836b5ccf3ec344f7a5fbfeab50e58dcdb4e7afc
-
memory/3980-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/3980-3-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/3980-4-0x0000000006350000-0x0000000006351000-memory.dmpFilesize
4KB
-
memory/3980-5-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/3980-6-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/3980-7-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/3980-8-0x0000000005A90000-0x0000000005AA3000-memory.dmpFilesize
76KB
-
memory/3980-9-0x0000000006B10000-0x0000000006B7A000-memory.dmpFilesize
424KB
-
memory/3980-10-0x0000000006B80000-0x0000000006BB5000-memory.dmpFilesize
212KB
-
memory/3980-0-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/4068-15-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/4068-27-0x0000000006940000-0x0000000006946000-memory.dmpFilesize
24KB
-
memory/4068-14-0x000000000041E792-mapping.dmp
-
memory/4068-37-0x0000000006C00000-0x0000000006C01000-memory.dmpFilesize
4KB
-
memory/4068-22-0x0000000005790000-0x0000000005795000-memory.dmpFilesize
20KB
-
memory/4068-23-0x00000000057A0000-0x00000000057B9000-memory.dmpFilesize
100KB
-
memory/4068-24-0x0000000005AA0000-0x0000000005AA3000-memory.dmpFilesize
12KB
-
memory/4068-25-0x00000000067C0000-0x00000000067CD000-memory.dmpFilesize
52KB
-
memory/4068-26-0x00000000067D0000-0x00000000067E5000-memory.dmpFilesize
84KB
-
memory/4068-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4068-28-0x0000000006960000-0x000000000696C000-memory.dmpFilesize
48KB
-
memory/4068-29-0x0000000006970000-0x0000000006977000-memory.dmpFilesize
28KB
-
memory/4068-30-0x0000000006980000-0x0000000006986000-memory.dmpFilesize
24KB
-
memory/4068-31-0x0000000006990000-0x000000000699D000-memory.dmpFilesize
52KB
-
memory/4068-32-0x00000000069A0000-0x00000000069A9000-memory.dmpFilesize
36KB
-
memory/4068-33-0x00000000069B0000-0x00000000069BF000-memory.dmpFilesize
60KB
-
memory/4068-34-0x00000000069D0000-0x00000000069DA000-memory.dmpFilesize
40KB
-
memory/4068-35-0x00000000069E0000-0x0000000006A09000-memory.dmpFilesize
164KB
-
memory/4068-36-0x0000000006A20000-0x0000000006A2F000-memory.dmpFilesize
60KB
-
memory/4076-11-0x0000000000000000-mapping.dmp