Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-02-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
PROOF OF PAYMENT.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PROOF OF PAYMENT.exe
Resource
win10v20201028
General
-
Target
PROOF OF PAYMENT.exe
-
Size
888KB
-
MD5
5e5604114794f468c813d4d935a4cdbe
-
SHA1
84c54efd50e143c3aaaa260f66ae6841246b4582
-
SHA256
45c4c7350970052a201b3982897ff0247a9c461c60ecf52cd9fdc60aed38ffd7
-
SHA512
4ef4173d012a7337fb95a2e3dc1e40e82ad9dd8b3778cf4c4b8f2ccb75f14f742d523e2e5add49b23bc277d5819af8f66583e37517c2c58be2695cde5afd9660
Malware Config
Extracted
nanocore
1.2.2.0
amechi.duckdns.org:3190
88214ee8-a10b-488a-b7ab-62beb82df06b
-
activate_away_mode
true
-
backup_connection_host
amechi.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-12T19:59:26.466993536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3190
-
default_group
BST FREEDOM COLLECT
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
88214ee8-a10b-488a-b7ab-62beb82df06b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
amechi.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PROOF OF PAYMENT.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" PROOF OF PAYMENT.exe -
Processes:
PROOF OF PAYMENT.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PROOF OF PAYMENT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PROOF OF PAYMENT.exedescription pid process target process PID 732 set thread context of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe -
Drops file in Program Files directory 2 IoCs
Processes:
PROOF OF PAYMENT.exedescription ioc process File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe PROOF OF PAYMENT.exe File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe PROOF OF PAYMENT.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
PROOF OF PAYMENT.exePROOF OF PAYMENT.exepid process 732 PROOF OF PAYMENT.exe 2716 PROOF OF PAYMENT.exe 2716 PROOF OF PAYMENT.exe 2716 PROOF OF PAYMENT.exe 2716 PROOF OF PAYMENT.exe 2716 PROOF OF PAYMENT.exe 2716 PROOF OF PAYMENT.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
PROOF OF PAYMENT.exepid process 2716 PROOF OF PAYMENT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PROOF OF PAYMENT.exePROOF OF PAYMENT.exedescription pid process Token: SeDebugPrivilege 732 PROOF OF PAYMENT.exe Token: SeDebugPrivilege 2716 PROOF OF PAYMENT.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PROOF OF PAYMENT.exedescription pid process target process PID 732 wrote to memory of 2172 732 PROOF OF PAYMENT.exe schtasks.exe PID 732 wrote to memory of 2172 732 PROOF OF PAYMENT.exe schtasks.exe PID 732 wrote to memory of 2172 732 PROOF OF PAYMENT.exe schtasks.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe PID 732 wrote to memory of 2716 732 PROOF OF PAYMENT.exe PROOF OF PAYMENT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AIVwTQrYvQpnV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE228.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PROOF OF PAYMENT.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmpE228.tmpMD5
e91be2dc2f451a3a6391a215aa19b860
SHA1885f315fc6f7f96cd29cf86586d6430a7dd5f709
SHA256da8bf6146cccd384f3583e146877147a610242c4d26afed50e9d43773ca14f83
SHA51211077116f340ee980653eb512492345d697740d7f1072a5d9519bb4076d6e8e98b4c3d8a697386d58c62b291cc2e7700c2c084af8ae96c7dc9d62147a0bd7a43
-
memory/732-3-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/732-5-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/732-6-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/732-7-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/732-8-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/732-9-0x00000000051C0000-0x00000000051C4000-memory.dmpFilesize
16KB
-
memory/732-10-0x0000000008590000-0x0000000008591000-memory.dmpFilesize
4KB
-
memory/732-11-0x0000000008820000-0x00000000088EC000-memory.dmpFilesize
816KB
-
memory/732-2-0x00000000730E0000-0x00000000737CE000-memory.dmpFilesize
6.9MB
-
memory/2172-12-0x0000000000000000-mapping.dmp
-
memory/2716-25-0x0000000005360000-0x0000000005365000-memory.dmpFilesize
20KB
-
memory/2716-30-0x0000000006780000-0x0000000006786000-memory.dmpFilesize
24KB
-
memory/2716-15-0x000000000041E792-mapping.dmp
-
memory/2716-24-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/2716-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2716-26-0x0000000005550000-0x0000000005569000-memory.dmpFilesize
100KB
-
memory/2716-27-0x00000000055D0000-0x00000000055D3000-memory.dmpFilesize
12KB
-
memory/2716-28-0x0000000005FE0000-0x0000000005FED000-memory.dmpFilesize
52KB
-
memory/2716-29-0x0000000006750000-0x0000000006765000-memory.dmpFilesize
84KB
-
memory/2716-17-0x00000000730E0000-0x00000000737CE000-memory.dmpFilesize
6.9MB
-
memory/2716-31-0x0000000006790000-0x000000000679C000-memory.dmpFilesize
48KB
-
memory/2716-32-0x00000000067A0000-0x00000000067A6000-memory.dmpFilesize
24KB
-
memory/2716-33-0x00000000067B0000-0x00000000067B7000-memory.dmpFilesize
28KB
-
memory/2716-34-0x00000000067C0000-0x00000000067CD000-memory.dmpFilesize
52KB
-
memory/2716-35-0x00000000067D0000-0x00000000067D9000-memory.dmpFilesize
36KB
-
memory/2716-36-0x00000000067E0000-0x00000000067EF000-memory.dmpFilesize
60KB
-
memory/2716-37-0x0000000006800000-0x000000000680A000-memory.dmpFilesize
40KB
-
memory/2716-38-0x0000000006810000-0x0000000006839000-memory.dmpFilesize
164KB
-
memory/2716-39-0x0000000006850000-0x000000000685F000-memory.dmpFilesize
60KB
-
memory/2716-40-0x0000000006A20000-0x0000000006A21000-memory.dmpFilesize
4KB