Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-10-2021 17:53
Static task
static1
Behavioral task
behavioral1
Sample
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe
Resource
win7v20210408
General
-
Target
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe
-
Size
12KB
-
MD5
5b3262b61a5eaa3ebe7e8bdc4958fc3f
-
SHA1
112314d871226e07180bf2d0a2852120cbc1399f
-
SHA256
799a0831a87f80ddced683cf26c082c58c936a1bb868dd0e97552a9f035ba4ee
-
SHA512
319aa0970867ec79fb9c6b5f90d8d276eab4e59a7dfd6deab30c15f90651b80ea409c57f0fdc8e0e23eeac0621af0312cb0a4206f80e2f5e22d63b48ab7ddc57
Malware Config
Extracted
nanocore
1.2.2.0
cloudhost.myfirewall.org:5654
9845a945-f2ff-4e93-b909-aece664ddb48
-
activate_away_mode
true
-
backup_connection_host
cloudhost.myfirewall.org
-
backup_dns_server
cloudhost.myfirewall.org
-
buffer_size
65535
-
build_time
2021-06-20T04:14:27.248073436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5654
-
default_group
J
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9845a945-f2ff-4e93-b909-aece664ddb48
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
cloudhost.myfirewall.org
-
primary_dns_server
cloudhost.myfirewall.org
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe" 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exedescription pid process target process PID 900 set thread context of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Drops file in Program Files directory 2 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exedescription ioc process File created C:\Program Files (x86)\UPNP Subsystem\upnpss.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe File opened for modification C:\Program Files (x86)\UPNP Subsystem\upnpss.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1856 schtasks.exe 2236 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe5b3262b61a5eaa3ebe7e8bdc4958fc3f.exepid process 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exepid process 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe5b3262b61a5eaa3ebe7e8bdc4958fc3f.exedescription pid process Token: SeDebugPrivilege 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe Token: SeDebugPrivilege 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe5b3262b61a5eaa3ebe7e8bdc4958fc3f.exedescription pid process target process PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 900 wrote to memory of 2396 900 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe PID 2396 wrote to memory of 1856 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe schtasks.exe PID 2396 wrote to memory of 1856 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe schtasks.exe PID 2396 wrote to memory of 1856 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe schtasks.exe PID 2396 wrote to memory of 2236 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe schtasks.exe PID 2396 wrote to memory of 2236 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe schtasks.exe PID 2396 wrote to memory of 2236 2396 5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe"C:\Users\Admin\AppData\Local\Temp\5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b3262b61a5eaa3ebe7e8bdc4958fc3f.exeC:\Users\Admin\AppData\Local\Temp\5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB2C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC27.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe.logMD5
808e884c00533a9eb0e13e64960d9c3a
SHA1279d05181fc6179a12df1a669ff5d8b64c1380ae
SHA2562f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6
SHA5129489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299
-
C:\Users\Admin\AppData\Local\Temp\tmpB2C.tmpMD5
4a0ca515a4c7c277c2cdc11c14b8a444
SHA1c3acb3acf02a2833efbb75ac5480b890f681f694
SHA2562e230e44e199044afdc2f1d46b0f7f4c06697367cea123a052ab23279ba54c84
SHA51204b59007506f19ff43f1cafe1981eea068a00a97a4a899417218230a17b822fa5a135c30e89759715bab6f72655bc47080f31111610bdb30faf37663c4dd4297
-
C:\Users\Admin\AppData\Local\Temp\tmpC27.tmpMD5
af9986f5e128fd8bd3ae748fcba6576d
SHA18060072c35108b48649a03be91803b97f1ad40a4
SHA256f3242f6480b3d1a8f9285135fdce9a201c4802ce062eee4fb41c488a21d53303
SHA512f35c8e1699905bc972ae48a5a4a9fd33ea04b2d851ffc1cb1d1573a2087121d803b4186a696b2edad10a9c46c388a478e105f5a730020b598aa9f483086dba38
-
memory/900-116-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/900-117-0x0000000005D40000-0x0000000005DC5000-memory.dmpFilesize
532KB
-
memory/900-118-0x00000000062B0000-0x00000000062E3000-memory.dmpFilesize
204KB
-
memory/900-114-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1856-129-0x0000000000000000-mapping.dmp
-
memory/2236-131-0x0000000000000000-mapping.dmp
-
memory/2396-119-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2396-127-0x0000000004C80000-0x000000000517E000-memory.dmpFilesize
5.0MB
-
memory/2396-128-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/2396-126-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/2396-125-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/2396-124-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/2396-120-0x000000000041E792-mapping.dmp
-
memory/2396-133-0x0000000005040000-0x0000000005045000-memory.dmpFilesize
20KB
-
memory/2396-134-0x0000000005160000-0x0000000005179000-memory.dmpFilesize
100KB
-
memory/2396-135-0x0000000005E80000-0x0000000005E83000-memory.dmpFilesize
12KB