Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 07:50
Static task
static1
Behavioral task
behavioral1
Sample
Order_List_PO# 081929.exe
Resource
win7v20201028
General
-
Target
Order_List_PO# 081929.exe
-
Size
5.3MB
-
MD5
4883df19a41690e59eb5e4771dc7d432
-
SHA1
c5fc72385d8abb5be3f5d0281d723b3738fed66d
-
SHA256
b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
-
SHA512
2771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
Malware Config
Extracted
nanocore
1.2.2.0
185.157.162.81:40700
nanopc.linkpc.net:40700
ebbd9300-ed31-4d29-88d8-4f7b7a7f8653
-
activate_away_mode
true
-
backup_connection_host
nanopc.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-09-04T02:29:42.194822936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40700
-
default_group
LAGOS_BLESSED2
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
29933
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ebbd9300-ed31-4d29-88d8-4f7b7a7f8653
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.162.81
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
4944
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
mscuivedeoire.exeAddInProcess32.exeestaccynow.exeestaccynow.exepid process 268 mscuivedeoire.exe 292 AddInProcess32.exe 1604 estaccynow.exe 2008 estaccynow.exe -
Drops startup file 1 IoCs
Processes:
Order_List_PO# 081929.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscuivedeoire.lnk Order_List_PO# 081929.exe -
Loads dropped DLL 4 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeestaccynow.exepid process 1096 Order_List_PO# 081929.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe 1604 estaccynow.exe -
Processes:
AddInProcess32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mscuivedeoire.exedescription pid process target process PID 268 set thread context of 292 268 mscuivedeoire.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeAddInProcess32.exeestaccynow.exeestaccynow.exepid process 1096 Order_List_PO# 081929.exe 1096 Order_List_PO# 081929.exe 1096 Order_List_PO# 081929.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe 292 AddInProcess32.exe 292 AddInProcess32.exe 292 AddInProcess32.exe 1604 estaccynow.exe 2008 estaccynow.exe 2008 estaccynow.exe 2008 estaccynow.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe 268 mscuivedeoire.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AddInProcess32.exepid process 292 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeAddInProcess32.exeestaccynow.exeestaccynow.exedescription pid process Token: SeDebugPrivilege 1096 Order_List_PO# 081929.exe Token: SeDebugPrivilege 268 mscuivedeoire.exe Token: SeDebugPrivilege 292 AddInProcess32.exe Token: SeDebugPrivilege 1604 estaccynow.exe Token: SeDebugPrivilege 2008 estaccynow.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeestaccynow.exedescription pid process target process PID 1096 wrote to memory of 268 1096 Order_List_PO# 081929.exe mscuivedeoire.exe PID 1096 wrote to memory of 268 1096 Order_List_PO# 081929.exe mscuivedeoire.exe PID 1096 wrote to memory of 268 1096 Order_List_PO# 081929.exe mscuivedeoire.exe PID 1096 wrote to memory of 268 1096 Order_List_PO# 081929.exe mscuivedeoire.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 292 268 mscuivedeoire.exe AddInProcess32.exe PID 268 wrote to memory of 1604 268 mscuivedeoire.exe estaccynow.exe PID 268 wrote to memory of 1604 268 mscuivedeoire.exe estaccynow.exe PID 268 wrote to memory of 1604 268 mscuivedeoire.exe estaccynow.exe PID 268 wrote to memory of 1604 268 mscuivedeoire.exe estaccynow.exe PID 1604 wrote to memory of 2008 1604 estaccynow.exe estaccynow.exe PID 1604 wrote to memory of 2008 1604 estaccynow.exe estaccynow.exe PID 1604 wrote to memory of 2008 1604 estaccynow.exe estaccynow.exe PID 1604 wrote to memory of 2008 1604 estaccynow.exe estaccynow.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order_List_PO# 081929.exe"C:\Users\Admin\AppData\Local\Temp\Order_List_PO# 081929.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mscuivedeoire.exe"C:\Users\Admin\AppData\Roaming\mscuivedeoire.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.txtMD5
19cdf47745ff63f10fa9c6d1512f834f
SHA14bf3c23b76d3e97ffd2b93ba09802f28c5774001
SHA256f1ebc11b8d453eb13fef6ed7172b6ffe572e789500f5edcd9c2ee9ef9bc831fd
SHA5121905d3b738c0bda2537597f2a7e3548df0bf2e470c09c29fa993e3942c09177afd464d41a39c2b43fa97c04e8b49e7cf596536045318ed19589e66d62b5b4e81
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.txtMD5
c8d6d2460a5279a0323b1e421b418948
SHA1c21a41394d453dfbb51bf2454acdf9824166d54d
SHA2565b9407041e50f6c5d9890dc6f015eeac8cbb0f2ace1b60e8b8770e8f4bb234e9
SHA51289cfd1f6e8398bc26794d7781e32b5c275e34e5970f43839df0efb756a752c7f1e67acfbd9b8a3bc84ebfddff6585018f02fe6f55f2cf3fc27558d3f9ae1a4ac
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.txtMD5
c8d6d2460a5279a0323b1e421b418948
SHA1c21a41394d453dfbb51bf2454acdf9824166d54d
SHA2565b9407041e50f6c5d9890dc6f015eeac8cbb0f2ace1b60e8b8770e8f4bb234e9
SHA51289cfd1f6e8398bc26794d7781e32b5c275e34e5970f43839df0efb756a752c7f1e67acfbd9b8a3bc84ebfddff6585018f02fe6f55f2cf3fc27558d3f9ae1a4ac
-
C:\Users\Admin\AppData\Roaming\mscuivedeoire.exeMD5
4883df19a41690e59eb5e4771dc7d432
SHA1c5fc72385d8abb5be3f5d0281d723b3738fed66d
SHA256b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
SHA5122771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
-
C:\Users\Admin\AppData\Roaming\mscuivedeoire.exeMD5
4883df19a41690e59eb5e4771dc7d432
SHA1c5fc72385d8abb5be3f5d0281d723b3738fed66d
SHA256b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
SHA5122771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Roaming\mscuivedeoire.exeMD5
4883df19a41690e59eb5e4771dc7d432
SHA1c5fc72385d8abb5be3f5d0281d723b3738fed66d
SHA256b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
SHA5122771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
-
memory/268-13-0x0000000074CF0000-0x00000000753DE000-memory.dmpFilesize
6.9MB
-
memory/268-20-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/268-19-0x00000000004D0000-0x00000000004DB000-memory.dmpFilesize
44KB
-
memory/268-23-0x0000000004EA1000-0x0000000004EA2000-memory.dmpFilesize
4KB
-
memory/268-10-0x0000000000000000-mapping.dmp
-
memory/268-17-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/268-14-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/292-27-0x0000000074CF0000-0x00000000753DE000-memory.dmpFilesize
6.9MB
-
memory/292-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/292-30-0x00000000004D0000-0x00000000004D5000-memory.dmpFilesize
20KB
-
memory/292-31-0x0000000000610000-0x0000000000629000-memory.dmpFilesize
100KB
-
memory/292-32-0x00000000004E0000-0x00000000004E3000-memory.dmpFilesize
12KB
-
memory/292-33-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/292-25-0x000000000041E792-mapping.dmp
-
memory/292-28-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1096-2-0x0000000074CF0000-0x00000000753DE000-memory.dmpFilesize
6.9MB
-
memory/1096-8-0x0000000004E91000-0x0000000004E92000-memory.dmpFilesize
4KB
-
memory/1096-7-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1096-6-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/1096-5-0x0000000000340000-0x000000000035E000-memory.dmpFilesize
120KB
-
memory/1096-3-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/1604-36-0x0000000000000000-mapping.dmp
-
memory/1604-39-0x0000000074CF0000-0x00000000753DE000-memory.dmpFilesize
6.9MB
-
memory/1604-40-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/2008-44-0x0000000000000000-mapping.dmp
-
memory/2008-46-0x0000000074CF0000-0x00000000753DE000-memory.dmpFilesize
6.9MB