Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 16:00
Static task
static1
Behavioral task
behavioral1
Sample
DINTEC PO.exe
Resource
win7v20201028
General
-
Target
DINTEC PO.exe
-
Size
842KB
-
MD5
f1d00b68162820d29eb884a91b9e6a09
-
SHA1
406621cc2e30d19645513296fe1c5f50dd6c3848
-
SHA256
29800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
-
SHA512
b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
Malware Config
Extracted
nanocore
1.2.2.0
mnvh54254.ddns.net:6653
ffdfcbd2-3989-4236-a47d-b9533fb19ad2
-
activate_away_mode
true
-
backup_connection_host
mnvh54254.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-23T12:25:44.065726836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
6653
-
default_group
AMMAGEDOM001
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ffdfcbd2-3989-4236-a47d-b9533fb19ad2
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
mnvh54254.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
a.exeInstallUtil.exepid process 308 a.exe 616 InstallUtil.exe -
Drops startup file 1 IoCs
Processes:
DINTEC PO.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a.lnk DINTEC PO.exe -
Loads dropped DLL 2 IoCs
Processes:
DINTEC PO.exea.exepid process 1824 DINTEC PO.exe 308 a.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Host = "C:\\Program Files (x86)\\WPA Host\\wpahost.exe" InstallUtil.exe -
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallUtil.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a.exeInstallUtil.exedescription pid process target process PID 308 set thread context of 616 308 a.exe InstallUtil.exe PID 616 set thread context of 884 616 InstallUtil.exe vbc.exe PID 616 set thread context of 1348 616 InstallUtil.exe vbc.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\WPA Host\wpahost.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\WPA Host\wpahost.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
DINTEC PO.exea.exeInstallUtil.exepid process 1824 DINTEC PO.exe 1824 DINTEC PO.exe 1824 DINTEC PO.exe 1824 DINTEC PO.exe 1824 DINTEC PO.exe 308 a.exe 308 a.exe 616 InstallUtil.exe 616 InstallUtil.exe 616 InstallUtil.exe 616 InstallUtil.exe 616 InstallUtil.exe 616 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 616 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DINTEC PO.exea.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1824 DINTEC PO.exe Token: SeDebugPrivilege 308 a.exe Token: SeDebugPrivilege 616 InstallUtil.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
DINTEC PO.exea.exeInstallUtil.exedescription pid process target process PID 1824 wrote to memory of 308 1824 DINTEC PO.exe a.exe PID 1824 wrote to memory of 308 1824 DINTEC PO.exe a.exe PID 1824 wrote to memory of 308 1824 DINTEC PO.exe a.exe PID 1824 wrote to memory of 308 1824 DINTEC PO.exe a.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 308 wrote to memory of 616 308 a.exe InstallUtil.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 884 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe PID 616 wrote to memory of 1348 616 InstallUtil.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DINTEC PO.exe"C:\Users\Admin\AppData\Local\Temp\DINTEC PO.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\a.exe"C:\Users\Admin\AppData\Roaming\a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe"c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\pn5ubd5l.pcm"4⤵
-
\??\c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe"c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\dx3mumjx.ltl"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\dx3mumjx.ltlMD5
919e671c3d5959a91ef2d4c377d2b2ff
SHA1b1202b19512bbd390d3d5164792501c87bb42c41
SHA256d2e079df7cf6388315368ba79bf099ad2ff5428af51bf5abf2d99a2d7c5eb651
SHA512f3298256372beab8efe81b2e08d3b3869281f625de1ee13189c6b95eb2134d223df6f64cc9e490dd6b52a53aa936adc17bd5dfe4e50ee0fe420f3ebae276381c
-
C:\Users\Admin\AppData\Local\Temp\pn5ubd5l.pcmMD5
69b2a2e17e78d24abee9f1de2f04811a
SHA1d19c109704e83876ab3527457f9418a7d053aa33
SHA2561b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd
SHA512eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f
-
C:\Users\Admin\AppData\Roaming\a.exeMD5
f1d00b68162820d29eb884a91b9e6a09
SHA1406621cc2e30d19645513296fe1c5f50dd6c3848
SHA25629800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
SHA512b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
-
C:\Users\Admin\AppData\Roaming\a.exeMD5
f1d00b68162820d29eb884a91b9e6a09
SHA1406621cc2e30d19645513296fe1c5f50dd6c3848
SHA25629800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
SHA512b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Roaming\a.exeMD5
f1d00b68162820d29eb884a91b9e6a09
SHA1406621cc2e30d19645513296fe1c5f50dd6c3848
SHA25629800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
SHA512b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
-
memory/308-8-0x0000000000000000-mapping.dmp
-
memory/308-11-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/308-12-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/308-16-0x00000000006E0000-0x00000000006EB000-memory.dmpFilesize
44KB
-
memory/308-17-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/616-30-0x00000000006E0000-0x00000000006E3000-memory.dmpFilesize
12KB
-
memory/616-36-0x00000000008D0000-0x00000000008D6000-memory.dmpFilesize
24KB
-
memory/616-21-0x000000000041E792-mapping.dmp
-
memory/616-40-0x0000000000990000-0x000000000099A000-memory.dmpFilesize
40KB
-
memory/616-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/616-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/616-25-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/616-28-0x0000000000660000-0x0000000000665000-memory.dmpFilesize
20KB
-
memory/616-29-0x00000000006B0000-0x00000000006C9000-memory.dmpFilesize
100KB
-
memory/616-41-0x00000000021E0000-0x0000000002209000-memory.dmpFilesize
164KB
-
memory/616-31-0x00000000007D0000-0x00000000007DD000-memory.dmpFilesize
52KB
-
memory/616-32-0x00000000007E0000-0x00000000007F5000-memory.dmpFilesize
84KB
-
memory/616-35-0x00000000008C0000-0x00000000008C7000-memory.dmpFilesize
28KB
-
memory/616-38-0x0000000000970000-0x0000000000979000-memory.dmpFilesize
36KB
-
memory/616-37-0x0000000000920000-0x000000000092D000-memory.dmpFilesize
52KB
-
memory/616-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/616-34-0x0000000000870000-0x000000000087C000-memory.dmpFilesize
48KB
-
memory/616-33-0x0000000000850000-0x0000000000856000-memory.dmpFilesize
24KB
-
memory/616-39-0x0000000000980000-0x000000000098F000-memory.dmpFilesize
60KB
-
memory/616-42-0x0000000000AA0000-0x0000000000AAF000-memory.dmpFilesize
60KB
-
memory/884-43-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/884-44-0x0000000000411654-mapping.dmp
-
memory/884-45-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1348-47-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1348-48-0x0000000000442628-mapping.dmp
-
memory/1348-49-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1824-2-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/1824-6-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1824-5-0x0000000000370000-0x000000000038E000-memory.dmpFilesize
120KB
-
memory/1824-50-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB
-
memory/1824-3-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB