Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 07:50
Static task
static1
Behavioral task
behavioral1
Sample
Order_List_PO# 081929.exe
Resource
win7v20201028
General
-
Target
Order_List_PO# 081929.exe
-
Size
5.3MB
-
MD5
4883df19a41690e59eb5e4771dc7d432
-
SHA1
c5fc72385d8abb5be3f5d0281d723b3738fed66d
-
SHA256
b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
-
SHA512
2771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
Malware Config
Extracted
nanocore
1.2.2.0
185.157.162.81:40700
nanopc.linkpc.net:40700
ebbd9300-ed31-4d29-88d8-4f7b7a7f8653
-
activate_away_mode
true
-
backup_connection_host
nanopc.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-09-04T02:29:42.194822936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
40700
-
default_group
LAGOS_BLESSED2
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
29933
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ebbd9300-ed31-4d29-88d8-4f7b7a7f8653
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.162.81
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
4944
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
mscuivedeoire.exeAddInProcess32.exeestaccynow.exeestaccynow.exepid process 2276 mscuivedeoire.exe 3956 AddInProcess32.exe 2192 estaccynow.exe 4076 estaccynow.exe -
Drops startup file 1 IoCs
Processes:
Order_List_PO# 081929.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscuivedeoire.lnk Order_List_PO# 081929.exe -
Processes:
AddInProcess32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mscuivedeoire.exedescription pid process target process PID 2276 set thread context of 3956 2276 mscuivedeoire.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeAddInProcess32.exeestaccynow.exeestaccynow.exepid process 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 3116 Order_List_PO# 081929.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 3956 AddInProcess32.exe 3956 AddInProcess32.exe 3956 AddInProcess32.exe 2192 estaccynow.exe 4076 estaccynow.exe 4076 estaccynow.exe 4076 estaccynow.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe 2276 mscuivedeoire.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AddInProcess32.exepid process 3956 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeAddInProcess32.exeestaccynow.exeestaccynow.exedescription pid process Token: SeDebugPrivilege 3116 Order_List_PO# 081929.exe Token: SeDebugPrivilege 2276 mscuivedeoire.exe Token: SeDebugPrivilege 3956 AddInProcess32.exe Token: SeDebugPrivilege 2192 estaccynow.exe Token: SeDebugPrivilege 4076 estaccynow.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Order_List_PO# 081929.exemscuivedeoire.exeestaccynow.exedescription pid process target process PID 3116 wrote to memory of 2276 3116 Order_List_PO# 081929.exe mscuivedeoire.exe PID 3116 wrote to memory of 2276 3116 Order_List_PO# 081929.exe mscuivedeoire.exe PID 3116 wrote to memory of 2276 3116 Order_List_PO# 081929.exe mscuivedeoire.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 3956 2276 mscuivedeoire.exe AddInProcess32.exe PID 2276 wrote to memory of 2192 2276 mscuivedeoire.exe estaccynow.exe PID 2276 wrote to memory of 2192 2276 mscuivedeoire.exe estaccynow.exe PID 2276 wrote to memory of 2192 2276 mscuivedeoire.exe estaccynow.exe PID 2192 wrote to memory of 4076 2192 estaccynow.exe estaccynow.exe PID 2192 wrote to memory of 4076 2192 estaccynow.exe estaccynow.exe PID 2192 wrote to memory of 4076 2192 estaccynow.exe estaccynow.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order_List_PO# 081929.exe"C:\Users\Admin\AppData\Local\Temp\Order_List_PO# 081929.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mscuivedeoire.exe"C:\Users\Admin\AppData\Roaming\mscuivedeoire.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"C:\Users\Admin\AppData\Local\Temp\estaccynow.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\estaccynow.exe.logMD5
e555c48cb712a9597ecb55a60135d1f8
SHA12081c72d30c34ec3f61f9944545ecdaae11521f7
SHA256815c80df060afa8acf7640ca011735ef77c66666d03901e04a8767827d5da4e9
SHA51232129b5be15217e5400f1e7536270a703d62db60ebb06396b9d74703e6a0dcd2e78f7f42b2019093be1508a9310912f305b88de274a295c9135a4086cd8c8427
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.txtMD5
148754ee04a442f0d4fa0ef5858f2464
SHA15d87107c80ed402aa5e89ad25817e6a97a760b5c
SHA256ce4ce0b7c48c0c96f802ca6cabe33c5e8042c7c1e4bc917d5f9db20d0921ac0d
SHA512ab7a92d6a425e04cbda527ff56e4518f3fa91c912bd72a1b3f63347fd8187314a0c897f271c8059ac7930c10cb19b8d9794c5387412b95d5d24b7585bbdbed70
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.txtMD5
2b76ced98c41f639b2e39108e3437f70
SHA1feb30a22853037d1b8b118373eae45e9c085f536
SHA25611fb70f7b7e0063afc58d7aed350fd56dc46e2d3970edc8e0881d1139d2ab0c9
SHA512db2d12de782e35a4e1622baed51bb97c91ac1bdb10660089433dce1dc5d38bccf7cba42ffaffd87235545a9887cafcbbddcbfdc5a5dae8f0ad9f4ea156db7019
-
C:\Users\Admin\AppData\Local\Temp\estaccynow.txtMD5
613ca0c18c01b481073be0a4ce3ffcc6
SHA11bbb1d88e60a0b12cd7e42d249997c188e41b745
SHA2560e3e914556f12f2cf83e9c1efa7c5ea899600144613fd69d880da477657df5fa
SHA5124b71633449314e38bdaed1493959b65e944383f364ea9e057def97555e91a9a1c6097c35415d34fe5251680336ef22717f338d0e81343ffb4a1df8c66c4c1b04
-
C:\Users\Admin\AppData\Roaming\mscuivedeoire.exeMD5
4883df19a41690e59eb5e4771dc7d432
SHA1c5fc72385d8abb5be3f5d0281d723b3738fed66d
SHA256b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
SHA5122771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
-
C:\Users\Admin\AppData\Roaming\mscuivedeoire.exeMD5
4883df19a41690e59eb5e4771dc7d432
SHA1c5fc72385d8abb5be3f5d0281d723b3738fed66d
SHA256b3e06e10d739a4e4c6207dba909e57c264994c09543a5101fe52da860e8a09a9
SHA5122771a8f587ff67f951057ca09ec73c8706affad4032af8fc918d9e3077f83f8e894ba73986b2f7826c02bfbace35227507b74e984b26bfa17b3c73597b0c38f9
-
memory/2192-40-0x0000000000000000-mapping.dmp
-
memory/2192-44-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/2192-43-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/2276-22-0x0000000005AA0000-0x0000000005AAB000-memory.dmpFilesize
44KB
-
memory/2276-23-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/2276-24-0x0000000005C41000-0x0000000005C42000-memory.dmpFilesize
4KB
-
memory/2276-14-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/2276-21-0x0000000005C40000-0x0000000005C41000-memory.dmpFilesize
4KB
-
memory/2276-11-0x0000000000000000-mapping.dmp
-
memory/3116-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/3116-6-0x0000000005E00000-0x0000000005E01000-memory.dmpFilesize
4KB
-
memory/3116-7-0x00000000034C0000-0x00000000034DE000-memory.dmpFilesize
120KB
-
memory/3116-8-0x0000000001B30000-0x0000000001B31000-memory.dmpFilesize
4KB
-
memory/3116-5-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/3116-10-0x0000000005E01000-0x0000000005E02000-memory.dmpFilesize
4KB
-
memory/3116-9-0x0000000008570000-0x0000000008571000-memory.dmpFilesize
4KB
-
memory/3116-2-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/3956-26-0x000000000041E792-mapping.dmp
-
memory/3956-39-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/3956-38-0x00000000054B0000-0x00000000054B3000-memory.dmpFilesize
12KB
-
memory/3956-37-0x00000000052B0000-0x00000000052C9000-memory.dmpFilesize
100KB
-
memory/3956-36-0x00000000052A0000-0x00000000052A5000-memory.dmpFilesize
20KB
-
memory/3956-35-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/3956-32-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/3956-29-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/3956-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4076-48-0x0000000000000000-mapping.dmp
-
memory/4076-51-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB