Analysis
-
max time kernel
66s -
max time network
189s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-07-2021 11:06
Static task
static1
Behavioral task
behavioral1
Sample
Order List.gz.exe
Resource
win7v20210410
General
-
Target
Order List.gz.exe
-
Size
697KB
-
MD5
e0f6bbc12ebe2102cf3fcf74f9d690d9
-
SHA1
203b28ec0fcb113bf1ac37ffba917b94cab9e85b
-
SHA256
35d212409544435a45ce577615da11f75cc4cf6dc56bce849651aede5c1ae437
-
SHA512
7e711a6a18d561244413b9ebcfba52ed353d8eea3ecd379a39038a172ed4a2b31e5ddead87d0a6d969a9edf7c3fe782852733a5a55862fd6ed2a164161fcadc6
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.100:1985
127.0.0.1:1985
b10f8b74-4448-4597-840b-1e44a5084bfc
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-04-30T10:29:24.181451236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1985
-
default_group
OBO
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b10f8b74-4448-4597-840b-1e44a5084bfc
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
79.134.225.100
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1164-62-0x0000000000350000-0x000000000035B000-memory.dmp CustAttr -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Host = "C:\\Program Files (x86)\\LAN Host\\lanhost.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order List.gz.exedescription pid process target process PID 1164 set thread context of 764 1164 Order List.gz.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\LAN Host\lanhost.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\LAN Host\lanhost.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
Order List.gz.exepowershell.exeRegSvcs.exepid process 1164 Order List.gz.exe 760 powershell.exe 764 RegSvcs.exe 764 RegSvcs.exe 764 RegSvcs.exe 760 powershell.exe 764 RegSvcs.exe 764 RegSvcs.exe 764 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 764 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Order List.gz.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1164 Order List.gz.exe Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 764 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Order List.gz.exedescription pid process target process PID 1164 wrote to memory of 760 1164 Order List.gz.exe powershell.exe PID 1164 wrote to memory of 760 1164 Order List.gz.exe powershell.exe PID 1164 wrote to memory of 760 1164 Order List.gz.exe powershell.exe PID 1164 wrote to memory of 760 1164 Order List.gz.exe powershell.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe PID 1164 wrote to memory of 764 1164 Order List.gz.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order List.gz.exe"C:\Users\Admin\AppData\Local\Temp\Order List.gz.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Order List.gz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-78-0x0000000004860000-0x0000000004861000-memory.dmpFilesize
4KB
-
memory/760-114-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/760-113-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/760-99-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/760-98-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/760-65-0x0000000000000000-mapping.dmp
-
memory/760-66-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/760-91-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/760-90-0x00000000060C0000-0x00000000060C1000-memory.dmpFilesize
4KB
-
memory/760-85-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/760-71-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/760-72-0x00000000048A0000-0x00000000048A1000-memory.dmpFilesize
4KB
-
memory/760-84-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/760-79-0x0000000004862000-0x0000000004863000-memory.dmpFilesize
4KB
-
memory/760-80-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/760-76-0x0000000001100000-0x0000000001101000-memory.dmpFilesize
4KB
-
memory/764-81-0x0000000004BA5000-0x0000000004BB6000-memory.dmpFilesize
68KB
-
memory/764-115-0x00000000005B0000-0x00000000005BD000-memory.dmpFilesize
52KB
-
memory/764-75-0x0000000000580000-0x0000000000583000-memory.dmpFilesize
12KB
-
memory/764-74-0x0000000000460000-0x0000000000479000-memory.dmpFilesize
100KB
-
memory/764-126-0x00000000041A0000-0x00000000041AF000-memory.dmpFilesize
60KB
-
memory/764-73-0x0000000000450000-0x0000000000455000-memory.dmpFilesize
20KB
-
memory/764-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/764-68-0x000000000041E792-mapping.dmp
-
memory/764-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/764-125-0x0000000004170000-0x0000000004199000-memory.dmpFilesize
164KB
-
memory/764-124-0x0000000002010000-0x000000000201A000-memory.dmpFilesize
40KB
-
memory/764-123-0x0000000000730000-0x000000000073F000-memory.dmpFilesize
60KB
-
memory/764-122-0x0000000000720000-0x0000000000729000-memory.dmpFilesize
36KB
-
memory/764-77-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/764-116-0x00000000005C0000-0x00000000005D5000-memory.dmpFilesize
84KB
-
memory/764-117-0x0000000000630000-0x0000000000636000-memory.dmpFilesize
24KB
-
memory/764-119-0x0000000000660000-0x0000000000667000-memory.dmpFilesize
28KB
-
memory/764-118-0x0000000000640000-0x000000000064C000-memory.dmpFilesize
48KB
-
memory/764-120-0x0000000000700000-0x0000000000706000-memory.dmpFilesize
24KB
-
memory/764-121-0x0000000000710000-0x000000000071D000-memory.dmpFilesize
52KB
-
memory/1164-61-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/1164-62-0x0000000000350000-0x000000000035B000-memory.dmpFilesize
44KB
-
memory/1164-63-0x00000000059D0000-0x0000000005A4A000-memory.dmpFilesize
488KB
-
memory/1164-64-0x00000000008A0000-0x00000000008D5000-memory.dmpFilesize
212KB
-
memory/1164-59-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB