Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-01-2021 07:29
Static task
static1
Behavioral task
behavioral1
Sample
81a6ff876eed37e77d4424b85f28969c.exe
Resource
win7v20201028
General
-
Target
81a6ff876eed37e77d4424b85f28969c.exe
-
Size
981KB
-
MD5
81a6ff876eed37e77d4424b85f28969c
-
SHA1
955a9fed685bd82126dabf386b83edd3571fcc21
-
SHA256
dc1cb9432a84c26de67dd7a2d9ce4d0ebf582af3862b2825f71b8e6fd12c0790
-
SHA512
8cd949770f7e0a2af4d437a57f0b7faff67c7ace6ef03bcac13b7fcd0ae77bea47b3b78f288e06ab3b07f97389416a4f53bb8575cfb6cb2d110e31fd8d64ee03
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.87:1144
nazareen12.ddns.net:1144
ba6cce4a-8474-40f3-8a06-f54f0d8bad9e
-
activate_away_mode
true
-
backup_connection_host
nazareen12.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-09-21T16:18:52.563488536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1144
-
default_group
New Start
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ba6cce4a-8474-40f3-8a06-f54f0d8bad9e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.87
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
chromee.exeInstallUtil.exepid process 3956 chromee.exe 1580 InstallUtil.exe -
Drops startup file 3 IoCs
Processes:
81a6ff876eed37e77d4424b85f28969c.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.lnk 81a6ff876eed37e77d4424b85f28969c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.exe 81a6ff876eed37e77d4424b85f28969c.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.exe 81a6ff876eed37e77d4424b85f28969c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" InstallUtil.exe -
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chromee.exedescription pid process target process PID 3956 set thread context of 1580 3956 chromee.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe InstallUtil.exe File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
81a6ff876eed37e77d4424b85f28969c.exechromee.exeInstallUtil.exepid process 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 728 81a6ff876eed37e77d4424b85f28969c.exe 3956 chromee.exe 3956 chromee.exe 1580 InstallUtil.exe 1580 InstallUtil.exe 1580 InstallUtil.exe 1580 InstallUtil.exe 1580 InstallUtil.exe 1580 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 1580 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
81a6ff876eed37e77d4424b85f28969c.exechromee.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 728 81a6ff876eed37e77d4424b85f28969c.exe Token: SeDebugPrivilege 3956 chromee.exe Token: SeDebugPrivilege 1580 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
81a6ff876eed37e77d4424b85f28969c.exechromee.exedescription pid process target process PID 728 wrote to memory of 3956 728 81a6ff876eed37e77d4424b85f28969c.exe chromee.exe PID 728 wrote to memory of 3956 728 81a6ff876eed37e77d4424b85f28969c.exe chromee.exe PID 728 wrote to memory of 3956 728 81a6ff876eed37e77d4424b85f28969c.exe chromee.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe PID 3956 wrote to memory of 1580 3956 chromee.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a6ff876eed37e77d4424b85f28969c.exe"C:\Users\Admin\AppData\Local\Temp\81a6ff876eed37e77d4424b85f28969c.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.exeMD5
81a6ff876eed37e77d4424b85f28969c
SHA1955a9fed685bd82126dabf386b83edd3571fcc21
SHA256dc1cb9432a84c26de67dd7a2d9ce4d0ebf582af3862b2825f71b8e6fd12c0790
SHA5128cd949770f7e0a2af4d437a57f0b7faff67c7ace6ef03bcac13b7fcd0ae77bea47b3b78f288e06ab3b07f97389416a4f53bb8575cfb6cb2d110e31fd8d64ee03
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.exeMD5
81a6ff876eed37e77d4424b85f28969c
SHA1955a9fed685bd82126dabf386b83edd3571fcc21
SHA256dc1cb9432a84c26de67dd7a2d9ce4d0ebf582af3862b2825f71b8e6fd12c0790
SHA5128cd949770f7e0a2af4d437a57f0b7faff67c7ace6ef03bcac13b7fcd0ae77bea47b3b78f288e06ab3b07f97389416a4f53bb8575cfb6cb2d110e31fd8d64ee03
-
memory/728-7-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/728-5-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/728-8-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/728-3-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/728-2-0x00000000730E0000-0x00000000737CE000-memory.dmpFilesize
6.9MB
-
memory/728-6-0x0000000004BA0000-0x0000000004BBE000-memory.dmpFilesize
120KB
-
memory/1580-34-0x00000000054E0000-0x00000000054F5000-memory.dmpFilesize
84KB
-
memory/1580-32-0x0000000005280000-0x0000000005285000-memory.dmpFilesize
20KB
-
memory/1580-21-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1580-22-0x000000000041E792-mapping.dmp
-
memory/1580-40-0x0000000006140000-0x0000000006169000-memory.dmpFilesize
164KB
-
memory/1580-41-0x0000000005FD0000-0x0000000005FDF000-memory.dmpFilesize
60KB
-
memory/1580-36-0x0000000005760000-0x000000000576F000-memory.dmpFilesize
60KB
-
memory/1580-28-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/1580-31-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/1580-39-0x0000000005FC0000-0x0000000005FC3000-memory.dmpFilesize
12KB
-
memory/1580-33-0x0000000005320000-0x000000000532D000-memory.dmpFilesize
52KB
-
memory/1580-38-0x0000000005FA0000-0x0000000005FB9000-memory.dmpFilesize
100KB
-
memory/1580-35-0x0000000005690000-0x0000000005696000-memory.dmpFilesize
24KB
-
memory/1580-25-0x00000000730E0000-0x00000000737CE000-memory.dmpFilesize
6.9MB
-
memory/1580-37-0x0000000005790000-0x000000000579A000-memory.dmpFilesize
40KB
-
memory/3956-12-0x00000000730E0000-0x00000000737CE000-memory.dmpFilesize
6.9MB
-
memory/3956-20-0x0000000003420000-0x0000000003421000-memory.dmpFilesize
4KB
-
memory/3956-19-0x0000000003400000-0x000000000340B000-memory.dmpFilesize
44KB
-
memory/3956-9-0x0000000000000000-mapping.dmp