Analysis
-
max time kernel
149s -
max time network
198s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-10-2021 17:18
Static task
static1
Behavioral task
behavioral1
Sample
KRSEL000005628600.PNG.scr
Resource
win7v20210408
General
-
Target
KRSEL000005628600.PNG.scr
-
Size
1.0MB
-
MD5
1f221e6e2a07d553e3fcf5bdb5874b2e
-
SHA1
0cd7541409f63dda3781d18c61bdcd74782192e6
-
SHA256
2d2f62269797be7ef763ac2da37e4c190381cfba8798e92e73ee9aa2084386f1
-
SHA512
6ba7d89395d226a8d11ade5be491d5d98ab7d64c4d27d8ccab284bbdd007bb9d97cd13c21010d2f54a05c75da7af349c79ddd00f16671016daaa5c4da1b6be63
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:48562
185.19.85.175:48562
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
activate_away_mode
false
-
backup_connection_host
185.19.85.175
- backup_dns_server
-
buffer_size
65538
-
build_time
2021-04-20T00:12:13.961451136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
HOBBIT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
bspmflqee.pifRegSvcs.exepid process 1244 bspmflqee.pif 524 RegSvcs.exe -
Loads dropped DLL 5 IoCs
Processes:
KRSEL000005628600.PNG.scrbspmflqee.pifpid process 1656 KRSEL000005628600.PNG.scr 1656 KRSEL000005628600.PNG.scr 1656 KRSEL000005628600.PNG.scr 1656 KRSEL000005628600.PNG.scr 1244 bspmflqee.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
RegSvcs.exebspmflqee.pifdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run bspmflqee.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\98025414\\BSPMFL~1.PIF C:\\Users\\Admin\\AppData\\Roaming\\98025414\\ewdsxu.ije" bspmflqee.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\98025414\\Update.vbs" bspmflqee.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bspmflqee.pifdescription pid process target process PID 1244 set thread context of 524 1244 bspmflqee.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DPI Service\dpisv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DPI Service\dpisv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1472 schtasks.exe 1968 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegSvcs.exepid process 524 RegSvcs.exe 524 RegSvcs.exe 524 RegSvcs.exe 524 RegSvcs.exe 524 RegSvcs.exe 524 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 524 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 524 RegSvcs.exe Token: SeDebugPrivilege 524 RegSvcs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
KRSEL000005628600.PNG.scrbspmflqee.pifRegSvcs.exedescription pid process target process PID 1656 wrote to memory of 1244 1656 KRSEL000005628600.PNG.scr bspmflqee.pif PID 1656 wrote to memory of 1244 1656 KRSEL000005628600.PNG.scr bspmflqee.pif PID 1656 wrote to memory of 1244 1656 KRSEL000005628600.PNG.scr bspmflqee.pif PID 1656 wrote to memory of 1244 1656 KRSEL000005628600.PNG.scr bspmflqee.pif PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 1244 wrote to memory of 524 1244 bspmflqee.pif RegSvcs.exe PID 524 wrote to memory of 1472 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1472 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1472 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1472 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1968 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1968 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1968 524 RegSvcs.exe schtasks.exe PID 524 wrote to memory of 1968 524 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KRSEL000005628600.PNG.scr"C:\Users\Admin\AppData\Local\Temp\KRSEL000005628600.PNG.scr" /S1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\98025414\bspmflqee.pif"C:\Users\Admin\AppData\Roaming\98025414\bspmflqee.pif" ewdsxu.ije2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3CD2.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3EB6.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp3CD2.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp3EB6.tmpMD5
a9af285136db016a568e4a53208f21d0
SHA1e1afef2b7ee8ae945353315daa19a15574b435b7
SHA2567dce876e35550f4a5b8ce8a8bbab3b0ccd7c5b8660f9db4b832466b77e3a8b7c
SHA51280a1f5e463a87cddc0f66336e2dc4262daf98984c6f6c662c3615d615ebe7c58677c3d694edb3bd7816ccee969aae967c7efe8526ba423f274ac1210c0c8bd6e
-
C:\Users\Admin\AppData\Roaming\98025414\bspmflqee.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\AppData\Roaming\98025414\ewdsxu.ijeMD5
88a7b78373eedc7c838ab5ade9628b9d
SHA1122a17b6e6e9fd2eeb875cabbe673a0886ba67be
SHA256b10b2a020300a668e155caaab629532793c4d0febe401b4b71b05025dffc2c1e
SHA51296d3c826353048f3f32ab9646a227e6e9b27ee879ff963587cb8d50c25423eea2e9aa8b824c642e08f7b6886856e7e858d81392d116838e0e675fe8abc941bc6
-
C:\Users\Admin\AppData\Roaming\98025414\owxpr.pdfMD5
04a33f4af4aff3027a40b095dad04a99
SHA19387782276caeef4b3d43dd9e9c6d3bdf968077d
SHA2561249b35f3978f85e5496eaeb12fab950bee9820b42dc84a3b99588b6669da073
SHA512a4510faf84e4a57c18ebeee1a7bd31bcd27b1169fdbe88263583c81c9f9037d3ce2ff9a3eac6f5b1e881ccce8265438f9ba458bb7cf164cc841d66cc2a44cfbe
-
C:\Users\Admin\AppData\Roaming\98025414\qustvis.buqMD5
c1d0f02492cc355266ee04f0f2c17c24
SHA1da8c0302f4877a9b10d263a43e970d8ea7edf57d
SHA256416505c75142609a8d79c3dc94260cb74942e1731fa1e198855ef8baeb166d3a
SHA51264e808c1581f5d41879b421447003e32d3ca81b2578e29f2177928e1b4e858310b3c0f202c4be426275f5fab5917a592616caf4090725469c47728e57562e859
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\98025414\bspmflqee.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\AppData\Roaming\98025414\bspmflqee.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\AppData\Roaming\98025414\bspmflqee.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\AppData\Roaming\98025414\bspmflqee.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
memory/524-73-0x00000000003A0000-0x0000000000938000-memory.dmpFilesize
5.6MB
-
memory/524-74-0x00000000003BE792-mapping.dmp
-
memory/524-77-0x00000000003A0000-0x0000000000938000-memory.dmpFilesize
5.6MB
-
memory/524-79-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/524-72-0x00000000003A0000-0x0000000000938000-memory.dmpFilesize
5.6MB
-
memory/524-84-0x0000000000BD0000-0x0000000000BD5000-memory.dmpFilesize
20KB
-
memory/524-85-0x0000000000CA0000-0x0000000000CA6000-memory.dmpFilesize
24KB
-
memory/524-86-0x0000000002570000-0x0000000002589000-memory.dmpFilesize
100KB
-
memory/524-87-0x0000000000D00000-0x0000000000D03000-memory.dmpFilesize
12KB
-
memory/1244-65-0x0000000000000000-mapping.dmp
-
memory/1472-80-0x0000000000000000-mapping.dmp
-
memory/1656-60-0x0000000075AA1000-0x0000000075AA3000-memory.dmpFilesize
8KB
-
memory/1968-82-0x0000000000000000-mapping.dmp