Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 16:00
Static task
static1
Behavioral task
behavioral1
Sample
DINTEC PO.exe
Resource
win7v20201028
General
-
Target
DINTEC PO.exe
-
Size
842KB
-
MD5
f1d00b68162820d29eb884a91b9e6a09
-
SHA1
406621cc2e30d19645513296fe1c5f50dd6c3848
-
SHA256
29800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
-
SHA512
b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
Malware Config
Extracted
nanocore
1.2.2.0
mnvh54254.ddns.net:6653
ffdfcbd2-3989-4236-a47d-b9533fb19ad2
-
activate_away_mode
true
-
backup_connection_host
mnvh54254.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-23T12:25:44.065726836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
6653
-
default_group
AMMAGEDOM001
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ffdfcbd2-3989-4236-a47d-b9533fb19ad2
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
mnvh54254.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
a.exeInstallUtil.exepid process 3844 a.exe 1280 InstallUtil.exe -
Drops startup file 1 IoCs
Processes:
DINTEC PO.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a.lnk DINTEC PO.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" InstallUtil.exe -
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a.exedescription pid process target process PID 3844 set thread context of 1280 3844 a.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
DINTEC PO.exea.exeInstallUtil.exepid process 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 1404 DINTEC PO.exe 3844 a.exe 3844 a.exe 1280 InstallUtil.exe 1280 InstallUtil.exe 1280 InstallUtil.exe 1280 InstallUtil.exe 1280 InstallUtil.exe 1280 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 1280 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DINTEC PO.exea.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1404 DINTEC PO.exe Token: SeDebugPrivilege 3844 a.exe Token: SeDebugPrivilege 1280 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
DINTEC PO.exea.exedescription pid process target process PID 1404 wrote to memory of 3844 1404 DINTEC PO.exe a.exe PID 1404 wrote to memory of 3844 1404 DINTEC PO.exe a.exe PID 1404 wrote to memory of 3844 1404 DINTEC PO.exe a.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe PID 3844 wrote to memory of 1280 3844 a.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DINTEC PO.exe"C:\Users\Admin\AppData\Local\Temp\DINTEC PO.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\a.exe"C:\Users\Admin\AppData\Roaming\a.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Roaming\a.exeMD5
f1d00b68162820d29eb884a91b9e6a09
SHA1406621cc2e30d19645513296fe1c5f50dd6c3848
SHA25629800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
SHA512b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
-
C:\Users\Admin\AppData\Roaming\a.exeMD5
f1d00b68162820d29eb884a91b9e6a09
SHA1406621cc2e30d19645513296fe1c5f50dd6c3848
SHA25629800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891
SHA512b9098f02c929f9a59b4adb846b47152d8ee69261d14558b3c2bf3bafd35ac2a81e690c02c1f5dc6f6bef694e4f79f668fbc16a20ab747914c570abe8f22901fe
-
memory/1280-25-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1280-32-0x0000000005320000-0x0000000005325000-memory.dmpFilesize
20KB
-
memory/1280-47-0x0000000006850000-0x0000000006851000-memory.dmpFilesize
4KB
-
memory/1280-46-0x0000000006680000-0x000000000668F000-memory.dmpFilesize
60KB
-
memory/1280-45-0x0000000006640000-0x0000000006669000-memory.dmpFilesize
164KB
-
memory/1280-44-0x0000000006630000-0x000000000663A000-memory.dmpFilesize
40KB
-
memory/1280-43-0x0000000006610000-0x000000000661F000-memory.dmpFilesize
60KB
-
memory/1280-42-0x0000000006600000-0x0000000006609000-memory.dmpFilesize
36KB
-
memory/1280-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1280-22-0x000000000041E792-mapping.dmp
-
memory/1280-41-0x00000000065F0000-0x00000000065FD000-memory.dmpFilesize
52KB
-
memory/1280-40-0x00000000065E0000-0x00000000065E6000-memory.dmpFilesize
24KB
-
memory/1280-39-0x00000000065D0000-0x00000000065D7000-memory.dmpFilesize
28KB
-
memory/1280-28-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/1280-31-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/1280-38-0x00000000065C0000-0x00000000065CC000-memory.dmpFilesize
48KB
-
memory/1280-33-0x0000000005370000-0x0000000005389000-memory.dmpFilesize
100KB
-
memory/1280-34-0x00000000053B0000-0x00000000053B3000-memory.dmpFilesize
12KB
-
memory/1280-35-0x00000000053C0000-0x00000000053CD000-memory.dmpFilesize
52KB
-
memory/1280-36-0x0000000006580000-0x0000000006595000-memory.dmpFilesize
84KB
-
memory/1280-37-0x00000000065B0000-0x00000000065B6000-memory.dmpFilesize
24KB
-
memory/1404-8-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/1404-2-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1404-3-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/1404-5-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/1404-6-0x0000000005490000-0x00000000054AE000-memory.dmpFilesize
120KB
-
memory/1404-7-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/3844-20-0x000000000B3E0000-0x000000000B3E1000-memory.dmpFilesize
4KB
-
memory/3844-19-0x0000000007F30000-0x0000000007F3B000-memory.dmpFilesize
44KB
-
memory/3844-12-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/3844-9-0x0000000000000000-mapping.dmp