Analysis
-
max time kernel
106s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 09:13
Static task
static1
Behavioral task
behavioral1
Sample
order-181289654312464648.exe
Resource
win7v20201028
General
-
Target
order-181289654312464648.exe
-
Size
5.5MB
-
MD5
28da42c2cd57e51cb8ea7df263802924
-
SHA1
81c980f2cda9b42b0b8bf50c7128cc88afd942fd
-
SHA256
2d564ae361eb499ca493273e9fcfb88546105c88293c7633a7e1580a435cee9f
-
SHA512
594ef84101106f21760953b8dd2660caa21fc6f08790b588875781b1233586a000cfae1d3a3001a1221762a08f18705e401c5af60f25d7e37032335346d9f828
Malware Config
Extracted
nanocore
1.2.2.0
185.157.162.81:40700
nanopc.linkpc.net:40700
ebbd9300-ed31-4d29-88d8-4f7b7a7f8653
-
activate_away_mode
true
-
backup_connection_host
nanopc.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-09-04T02:29:42.194822936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40700
-
default_group
LAGOS_BLESSED2
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
29933
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ebbd9300-ed31-4d29-88d8-4f7b7a7f8653
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.162.81
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
4944
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
fdcgjhjyuyihdastagghejh.exeAddInProcess32.exefdexedxfuuyytwq.exefdexedxfuuyytwq.exepid process 1016 fdcgjhjyuyihdastagghejh.exe 1804 AddInProcess32.exe 1560 fdexedxfuuyytwq.exe 1940 fdexedxfuuyytwq.exe -
Drops startup file 1 IoCs
Processes:
order-181289654312464648.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdcgjhjyuyihdastagghejh.lnk order-181289654312464648.exe -
Loads dropped DLL 4 IoCs
Processes:
order-181289654312464648.exefdcgjhjyuyihdastagghejh.exefdexedxfuuyytwq.exepid process 1580 order-181289654312464648.exe 1016 fdcgjhjyuyihdastagghejh.exe 1016 fdcgjhjyuyihdastagghejh.exe 1560 fdexedxfuuyytwq.exe -
Processes:
AddInProcess32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fdcgjhjyuyihdastagghejh.exedescription pid process target process PID 1016 set thread context of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
order-181289654312464648.exefdcgjhjyuyihdastagghejh.exeAddInProcess32.exefdexedxfuuyytwq.exefdexedxfuuyytwq.exepid process 1580 order-181289654312464648.exe 1580 order-181289654312464648.exe 1580 order-181289654312464648.exe 1580 order-181289654312464648.exe 1580 order-181289654312464648.exe 1016 fdcgjhjyuyihdastagghejh.exe 1016 fdcgjhjyuyihdastagghejh.exe 1016 fdcgjhjyuyihdastagghejh.exe 1804 AddInProcess32.exe 1804 AddInProcess32.exe 1804 AddInProcess32.exe 1560 fdexedxfuuyytwq.exe 1940 fdexedxfuuyytwq.exe 1940 fdexedxfuuyytwq.exe 1940 fdexedxfuuyytwq.exe 1016 fdcgjhjyuyihdastagghejh.exe 1016 fdcgjhjyuyihdastagghejh.exe 1016 fdcgjhjyuyihdastagghejh.exe 1016 fdcgjhjyuyihdastagghejh.exe 1804 AddInProcess32.exe 1804 AddInProcess32.exe 1804 AddInProcess32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AddInProcess32.exepid process 1804 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
order-181289654312464648.exefdcgjhjyuyihdastagghejh.exeAddInProcess32.exefdexedxfuuyytwq.exefdexedxfuuyytwq.exedescription pid process Token: SeDebugPrivilege 1580 order-181289654312464648.exe Token: SeDebugPrivilege 1016 fdcgjhjyuyihdastagghejh.exe Token: SeDebugPrivilege 1804 AddInProcess32.exe Token: SeDebugPrivilege 1560 fdexedxfuuyytwq.exe Token: SeDebugPrivilege 1940 fdexedxfuuyytwq.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
order-181289654312464648.exefdcgjhjyuyihdastagghejh.exefdexedxfuuyytwq.exedescription pid process target process PID 1580 wrote to memory of 1016 1580 order-181289654312464648.exe fdcgjhjyuyihdastagghejh.exe PID 1580 wrote to memory of 1016 1580 order-181289654312464648.exe fdcgjhjyuyihdastagghejh.exe PID 1580 wrote to memory of 1016 1580 order-181289654312464648.exe fdcgjhjyuyihdastagghejh.exe PID 1580 wrote to memory of 1016 1580 order-181289654312464648.exe fdcgjhjyuyihdastagghejh.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1804 1016 fdcgjhjyuyihdastagghejh.exe AddInProcess32.exe PID 1016 wrote to memory of 1560 1016 fdcgjhjyuyihdastagghejh.exe fdexedxfuuyytwq.exe PID 1016 wrote to memory of 1560 1016 fdcgjhjyuyihdastagghejh.exe fdexedxfuuyytwq.exe PID 1016 wrote to memory of 1560 1016 fdcgjhjyuyihdastagghejh.exe fdexedxfuuyytwq.exe PID 1016 wrote to memory of 1560 1016 fdcgjhjyuyihdastagghejh.exe fdexedxfuuyytwq.exe PID 1560 wrote to memory of 1940 1560 fdexedxfuuyytwq.exe fdexedxfuuyytwq.exe PID 1560 wrote to memory of 1940 1560 fdexedxfuuyytwq.exe fdexedxfuuyytwq.exe PID 1560 wrote to memory of 1940 1560 fdexedxfuuyytwq.exe fdexedxfuuyytwq.exe PID 1560 wrote to memory of 1940 1560 fdexedxfuuyytwq.exe fdexedxfuuyytwq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order-181289654312464648.exe"C:\Users\Admin\AppData\Local\Temp\order-181289654312464648.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fdcgjhjyuyihdastagghejh.exe"C:\Users\Admin\AppData\Roaming\fdcgjhjyuyihdastagghejh.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exe"C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exe"C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.txtMD5
8e943ef027a70fcbf4c6968fc99dbbc6
SHA1e4ee2a596045bb09f7abe7d202f6b8d5a20f20d6
SHA2566faa8bbd834343622cef112ae706925a407143ebb9e4f19de0d800016cb399ac
SHA512e6d734e473b3194fbd14948226d907b1e562cb7f0082df36f6528b883cef16e0c8e08b585f2b43e9fa31c76bf1ff1c8ba929e39eebe25b1f90d9e47fbe25d819
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.txtMD5
a1269f146354ee0d55e3516ed8c666f0
SHA1616da80c6ad25697b45f13d08b8ce8e9e8095aa2
SHA2564c9cac1aebfd0254b9279eb07addc6eb1b2bbd3aeeb193b6f4753c1de74cacda
SHA512565e396beb146d9eeb318ca4961d80394e6c4686c70c384dfbd5f1ebbc73413a169893d3b3d2b6162b43fe07f7a2efab9f3c461988c9b28980dee2b68afe81a4
-
C:\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.txtMD5
a1269f146354ee0d55e3516ed8c666f0
SHA1616da80c6ad25697b45f13d08b8ce8e9e8095aa2
SHA2564c9cac1aebfd0254b9279eb07addc6eb1b2bbd3aeeb193b6f4753c1de74cacda
SHA512565e396beb146d9eeb318ca4961d80394e6c4686c70c384dfbd5f1ebbc73413a169893d3b3d2b6162b43fe07f7a2efab9f3c461988c9b28980dee2b68afe81a4
-
C:\Users\Admin\AppData\Roaming\fdcgjhjyuyihdastagghejh.exeMD5
28da42c2cd57e51cb8ea7df263802924
SHA181c980f2cda9b42b0b8bf50c7128cc88afd942fd
SHA2562d564ae361eb499ca493273e9fcfb88546105c88293c7633a7e1580a435cee9f
SHA512594ef84101106f21760953b8dd2660caa21fc6f08790b588875781b1233586a000cfae1d3a3001a1221762a08f18705e401c5af60f25d7e37032335346d9f828
-
C:\Users\Admin\AppData\Roaming\fdcgjhjyuyihdastagghejh.exeMD5
28da42c2cd57e51cb8ea7df263802924
SHA181c980f2cda9b42b0b8bf50c7128cc88afd942fd
SHA2562d564ae361eb499ca493273e9fcfb88546105c88293c7633a7e1580a435cee9f
SHA512594ef84101106f21760953b8dd2660caa21fc6f08790b588875781b1233586a000cfae1d3a3001a1221762a08f18705e401c5af60f25d7e37032335346d9f828
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Local\Temp\fdexedxfuuyytwq.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Roaming\fdcgjhjyuyihdastagghejh.exeMD5
28da42c2cd57e51cb8ea7df263802924
SHA181c980f2cda9b42b0b8bf50c7128cc88afd942fd
SHA2562d564ae361eb499ca493273e9fcfb88546105c88293c7633a7e1580a435cee9f
SHA512594ef84101106f21760953b8dd2660caa21fc6f08790b588875781b1233586a000cfae1d3a3001a1221762a08f18705e401c5af60f25d7e37032335346d9f828
-
memory/1016-17-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/1016-16-0x0000000000460000-0x000000000046B000-memory.dmpFilesize
44KB
-
memory/1016-12-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1016-11-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1016-8-0x0000000000000000-mapping.dmp
-
memory/1560-32-0x0000000000000000-mapping.dmp
-
memory/1560-35-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1560-36-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1580-5-0x00000000004B0000-0x00000000004CE000-memory.dmpFilesize
120KB
-
memory/1580-6-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1580-3-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/1580-2-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1804-21-0x000000000041E792-mapping.dmp
-
memory/1804-48-0x0000000000640000-0x0000000000655000-memory.dmpFilesize
84KB
-
memory/1804-29-0x00000000004F0000-0x0000000000509000-memory.dmpFilesize
100KB
-
memory/1804-25-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1804-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1804-28-0x00000000004E0000-0x00000000004E5000-memory.dmpFilesize
20KB
-
memory/1804-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1804-57-0x00000000020D0000-0x00000000020F9000-memory.dmpFilesize
164KB
-
memory/1804-58-0x0000000000C40000-0x0000000000C4F000-memory.dmpFilesize
60KB
-
memory/1804-47-0x0000000000630000-0x000000000063D000-memory.dmpFilesize
52KB
-
memory/1804-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1804-30-0x0000000000610000-0x0000000000613000-memory.dmpFilesize
12KB
-
memory/1804-49-0x00000000006C0000-0x00000000006C6000-memory.dmpFilesize
24KB
-
memory/1804-50-0x00000000006D0000-0x00000000006DC000-memory.dmpFilesize
48KB
-
memory/1804-51-0x00000000006F0000-0x00000000006F7000-memory.dmpFilesize
28KB
-
memory/1804-52-0x0000000000700000-0x0000000000706000-memory.dmpFilesize
24KB
-
memory/1804-53-0x0000000000750000-0x000000000075D000-memory.dmpFilesize
52KB
-
memory/1804-54-0x0000000000760000-0x0000000000769000-memory.dmpFilesize
36KB
-
memory/1804-55-0x0000000000770000-0x000000000077F000-memory.dmpFilesize
60KB
-
memory/1804-56-0x0000000000780000-0x000000000078A000-memory.dmpFilesize
40KB
-
memory/1940-42-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1940-40-0x0000000000000000-mapping.dmp