Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
18-04-2021 17:56
Static task
static1
Behavioral task
behavioral1
Sample
192F43C51F4A671079872C28ABB01A64.exe
Resource
win7v20210408
General
-
Target
192F43C51F4A671079872C28ABB01A64.exe
-
Size
690KB
-
MD5
192f43c51f4a671079872c28abb01a64
-
SHA1
2fd4c2e5a93358c848061ba35628a814e6dac1bb
-
SHA256
d2ec2611b322552856d3f202484914625b49f0dc3326d8ea3acdb3a57e65b1ef
-
SHA512
36236e1bb1511b34dc7b8bbddb55a714059522677e54566e09e531a1cebd0de16119b4554f99020badc20caa4a72224a3addc68efbcdaaaf0026cf671e9e16a7
Malware Config
Extracted
nanocore
1.2.2.0
backu4734.duckdns.org:8092
ccf3c62d-d356-4a80-bb94-307bc35a5e01
-
activate_away_mode
false
-
backup_connection_host
backu4734.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-01-05T15:22:20.555580436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8092
-
default_group
Backup
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ccf3c62d-d356-4a80-bb94-307bc35a5e01
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
backu4734.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exepid process 1348 192F43C51F4A671079872C28ABB01A64.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe" 192F43C51F4A671079872C28ABB01A64.exe -
Processes:
192F43C51F4A671079872C28ABB01A64.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 192F43C51F4A671079872C28ABB01A64.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exedescription pid process target process PID 1348 set thread context of 1052 1348 192F43C51F4A671079872C28ABB01A64.exe 192F43C51F4A671079872C28ABB01A64.exe -
Drops file in Program Files directory 2 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exedescription ioc process File created C:\Program Files (x86)\DPI Service\dpisv.exe 192F43C51F4A671079872C28ABB01A64.exe File opened for modification C:\Program Files (x86)\DPI Service\dpisv.exe 192F43C51F4A671079872C28ABB01A64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exepid process 1052 192F43C51F4A671079872C28ABB01A64.exe 1052 192F43C51F4A671079872C28ABB01A64.exe 1052 192F43C51F4A671079872C28ABB01A64.exe 1052 192F43C51F4A671079872C28ABB01A64.exe 1052 192F43C51F4A671079872C28ABB01A64.exe 1052 192F43C51F4A671079872C28ABB01A64.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exepid process 1052 192F43C51F4A671079872C28ABB01A64.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exepid process 1348 192F43C51F4A671079872C28ABB01A64.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exedescription pid process Token: SeDebugPrivilege 1052 192F43C51F4A671079872C28ABB01A64.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
192F43C51F4A671079872C28ABB01A64.exe192F43C51F4A671079872C28ABB01A64.exedescription pid process target process PID 1348 wrote to memory of 1052 1348 192F43C51F4A671079872C28ABB01A64.exe 192F43C51F4A671079872C28ABB01A64.exe PID 1348 wrote to memory of 1052 1348 192F43C51F4A671079872C28ABB01A64.exe 192F43C51F4A671079872C28ABB01A64.exe PID 1348 wrote to memory of 1052 1348 192F43C51F4A671079872C28ABB01A64.exe 192F43C51F4A671079872C28ABB01A64.exe PID 1348 wrote to memory of 1052 1348 192F43C51F4A671079872C28ABB01A64.exe 192F43C51F4A671079872C28ABB01A64.exe PID 1348 wrote to memory of 1052 1348 192F43C51F4A671079872C28ABB01A64.exe 192F43C51F4A671079872C28ABB01A64.exe PID 1052 wrote to memory of 688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 1688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 1688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 1688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe PID 1052 wrote to memory of 1688 1052 192F43C51F4A671079872C28ABB01A64.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\192F43C51F4A671079872C28ABB01A64.exe"C:\Users\Admin\AppData\Local\Temp\192F43C51F4A671079872C28ABB01A64.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\192F43C51F4A671079872C28ABB01A64.exe"C:\Users\Admin\AppData\Local\Temp\192F43C51F4A671079872C28ABB01A64.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp24FE.tmp"3⤵
- Creates scheduled task(s)
PID:688 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2695.tmp"3⤵
- Creates scheduled task(s)
PID:1688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp24FE.tmpMD5
914c9c0ec8b02383ac0d53aeef5cdaa4
SHA1542b23eb21050810689ce818f63651a157f45558
SHA25664972199c4725e94293903699d6a9314e04d67c42c29d5d23b33c3be2bd59b25
SHA51210d522ccf9a0b0d4e6bde96e5f00b43a9ee86bc53580c573870932ca6307bb505087c44d910fb7cedf9216ec5066ee0748711abaae1a747e9a906d1cef5aa4f3
-
C:\Users\Admin\AppData\Local\Temp\tmp2695.tmpMD5
a9af285136db016a568e4a53208f21d0
SHA1e1afef2b7ee8ae945353315daa19a15574b435b7
SHA2567dce876e35550f4a5b8ce8a8bbab3b0ccd7c5b8660f9db4b832466b77e3a8b7c
SHA51280a1f5e463a87cddc0f66336e2dc4262daf98984c6f6c662c3615d615ebe7c58677c3d694edb3bd7816ccee969aae967c7efe8526ba423f274ac1210c0c8bd6e
-
\Users\Admin\AppData\Local\Temp\nss9658.tmp\o76acto.dllMD5
7faa067d6fadabc699ba34d9c7eb7a11
SHA1336715b289c2edb0eb7fa37a5fd47310683c800d
SHA256f0890e26b090e99ed0c52bb59befb6db350b937005f4855ba75665a6953cac07
SHA512cf86cc97ca035195e71f990c0010923d619c9866df5d0c2090023fb08b49a1027c198e159ba8fd696535141b2f9eaad1d4eac125405898beed5ad0e2a1200ac4
-
memory/688-73-0x0000000000000000-mapping.dmp
-
memory/1052-77-0x00000000045E0000-0x00000000045E5000-memory.dmpFilesize
20KB
-
memory/1052-80-0x0000000005130000-0x000000000513D000-memory.dmpFilesize
52KB
-
memory/1052-70-0x0000000004612000-0x0000000004613000-memory.dmpFilesize
4KB
-
memory/1052-69-0x0000000004611000-0x0000000004612000-memory.dmpFilesize
4KB
-
memory/1052-71-0x0000000004613000-0x0000000004614000-memory.dmpFilesize
4KB
-
memory/1052-72-0x0000000004614000-0x0000000004615000-memory.dmpFilesize
4KB
-
memory/1052-66-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/1052-64-0x000000000040188B-mapping.dmp
-
memory/1052-91-0x0000000005780000-0x000000000578F000-memory.dmpFilesize
60KB
-
memory/1052-90-0x0000000005750000-0x0000000005779000-memory.dmpFilesize
164KB
-
memory/1052-89-0x0000000005730000-0x000000000573A000-memory.dmpFilesize
40KB
-
memory/1052-78-0x0000000004F80000-0x0000000004F99000-memory.dmpFilesize
100KB
-
memory/1052-79-0x00000000045F0000-0x00000000045F3000-memory.dmpFilesize
12KB
-
memory/1052-67-0x0000000001F20000-0x0000000001F53000-memory.dmpFilesize
204KB
-
memory/1052-81-0x0000000005260000-0x0000000005275000-memory.dmpFilesize
84KB
-
memory/1052-82-0x00000000051D0000-0x00000000051D6000-memory.dmpFilesize
24KB
-
memory/1052-83-0x00000000056D0000-0x00000000056DC000-memory.dmpFilesize
48KB
-
memory/1052-84-0x00000000056E0000-0x00000000056E6000-memory.dmpFilesize
24KB
-
memory/1052-85-0x00000000056F0000-0x00000000056F7000-memory.dmpFilesize
28KB
-
memory/1052-86-0x0000000005700000-0x000000000570D000-memory.dmpFilesize
52KB
-
memory/1052-87-0x0000000005710000-0x0000000005719000-memory.dmpFilesize
36KB
-
memory/1052-88-0x0000000005720000-0x000000000572F000-memory.dmpFilesize
60KB
-
memory/1348-60-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1348-62-0x00000000026A0000-0x00000000032EA000-memory.dmpFilesize
12.3MB
-
memory/1688-75-0x0000000000000000-mapping.dmp