Analysis
-
max time kernel
158s -
max time network
167s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 08:25
Static task
static1
Behavioral task
behavioral1
Sample
b866823e1f8f4a52376bd108c457dd78.exe
Resource
win7v20210408
General
-
Target
b866823e1f8f4a52376bd108c457dd78.exe
-
Size
1.0MB
-
MD5
b866823e1f8f4a52376bd108c457dd78
-
SHA1
fe99849ec27630463080445337798eeba8000a02
-
SHA256
ebe1bb18a77cf0b34d3ad06919a9adfff2aa69cfafa5b96b670534b890e3e2a8
-
SHA512
fd1732ca7dc310395581d835ea3df1e7ad664c75c9c7f68ba55c0b2e521383a0c8781b490f7cc05428d6e534b356a585bf11b57e57808cc37ea08dabf4a09e13
Malware Config
Extracted
nanocore
1.2.2.0
ezeani.duckdns.org:8338
194.5.98.48:8338
c213d282-998c-4a04-8f80-944681ca75f6
-
activate_away_mode
true
-
backup_connection_host
194.5.98.48
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-25T02:31:51.856627236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8338
-
default_group
nano stub
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c213d282-998c-4a04-8f80-944681ca75f6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
ezeani.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
mmuiqlcvwo.pifmmuiqlcvwo.pifRegSvcs.exepid process 1284 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 1804 RegSvcs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
mmuiqlcvwo.pifmmuiqlcvwo.pifdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows element = "C:\\Users\\Admin\\33920049\\MMUIQL~1.PIF C:\\Users\\Admin\\33920049\\fmkkelc.omp" mmuiqlcvwo.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mmuiqlcvwo.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows element = "C:\\Users\\Admin\\33920049\\MMUIQL~1.PIF C:\\Users\\Admin\\33920049\\fmkkelc.omp" mmuiqlcvwo.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mmuiqlcvwo.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mmuiqlcvwo.pifdescription pid process target process PID 2588 set thread context of 1804 2588 mmuiqlcvwo.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
mmuiqlcvwo.pifdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings mmuiqlcvwo.pif -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
mmuiqlcvwo.pifmmuiqlcvwo.pifRegSvcs.exepid process 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 1284 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 1804 RegSvcs.exe 1804 RegSvcs.exe 1804 RegSvcs.exe 1804 RegSvcs.exe 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 1804 RegSvcs.exe 1804 RegSvcs.exe 1804 RegSvcs.exe 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 1804 RegSvcs.exe 1804 RegSvcs.exe 1804 RegSvcs.exe 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif 2588 mmuiqlcvwo.pif -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1804 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1804 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
b866823e1f8f4a52376bd108c457dd78.exemmuiqlcvwo.pifWScript.exemmuiqlcvwo.pifRegSvcs.exedescription pid process target process PID 1576 wrote to memory of 1284 1576 b866823e1f8f4a52376bd108c457dd78.exe mmuiqlcvwo.pif PID 1576 wrote to memory of 1284 1576 b866823e1f8f4a52376bd108c457dd78.exe mmuiqlcvwo.pif PID 1576 wrote to memory of 1284 1576 b866823e1f8f4a52376bd108c457dd78.exe mmuiqlcvwo.pif PID 1284 wrote to memory of 1828 1284 mmuiqlcvwo.pif WScript.exe PID 1284 wrote to memory of 1828 1284 mmuiqlcvwo.pif WScript.exe PID 1284 wrote to memory of 1828 1284 mmuiqlcvwo.pif WScript.exe PID 1828 wrote to memory of 2588 1828 WScript.exe mmuiqlcvwo.pif PID 1828 wrote to memory of 2588 1828 WScript.exe mmuiqlcvwo.pif PID 1828 wrote to memory of 2588 1828 WScript.exe mmuiqlcvwo.pif PID 2588 wrote to memory of 1804 2588 mmuiqlcvwo.pif RegSvcs.exe PID 2588 wrote to memory of 1804 2588 mmuiqlcvwo.pif RegSvcs.exe PID 2588 wrote to memory of 1804 2588 mmuiqlcvwo.pif RegSvcs.exe PID 2588 wrote to memory of 1804 2588 mmuiqlcvwo.pif RegSvcs.exe PID 2588 wrote to memory of 1804 2588 mmuiqlcvwo.pif RegSvcs.exe PID 1804 wrote to memory of 704 1804 RegSvcs.exe schtasks.exe PID 1804 wrote to memory of 704 1804 RegSvcs.exe schtasks.exe PID 1804 wrote to memory of 704 1804 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b866823e1f8f4a52376bd108c457dd78.exe"C:\Users\Admin\AppData\Local\Temp\b866823e1f8f4a52376bd108c457dd78.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\33920049\mmuiqlcvwo.pif"C:\Users\Admin\33920049\mmuiqlcvwo.pif" fmkkelc.omp2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\33920049\run.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\33920049\mmuiqlcvwo.pif"C:\Users\Admin\33920049\mmuiqlcvwo.pif" fmkkelc.omp4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3E8C.tmp"6⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\33920049\abjtjj.gcmMD5
1e44c5e2d839f53ac114916dfa41912b
SHA19b67abc94e2959683b5d784c8b076d6171af7237
SHA2560fb93824d410f1e4ba2b233f405027d042edf2e729fa34a41be910b50ed99416
SHA51214895d2f67585415d7d25807bba20f6aa8c142e8dd3483ed8e10f4280820cd0849ee828e3134beaf4a90fb8e41c9c524df01547330dfd3928470b3eeb95946a1
-
C:\Users\Admin\33920049\fmkkelc.ompMD5
66d7b16f566ad4d6f73cd6083c7b1d51
SHA1c71715b2546908a05a28a91555534f04bdf11432
SHA256440d3b688f65bd11c021206c50d7b7c4a75c7ba66bd2e1aa4137abe65d41079a
SHA5127ee084c1da1aabe2f7fcc084b4a9c5a9e5cfb86fb4fd45bc6ee08cd3e67fe41380d8fa0f0f312ec50198dc50ce230e36127ef5931ed455d9ce61efbd43e1a0ca
-
C:\Users\Admin\33920049\mmuiqlcvwo.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\33920049\mmuiqlcvwo.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\33920049\mmuiqlcvwo.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\33920049\qhqulleu.mp3MD5
5dc5d3365bae36fc41072d92d22f69cb
SHA191ce48060dcccc9806afb9979a3a1759041036df
SHA256067820a70679bc812c16421e4f759533dd91d8124ed36966436601b1f2013c94
SHA512ce2119181fcbda7c1b08068f918c7282defc8ad951e129458bb75f6cc9ec4ca105482b5f4aac4c16e425736fa45da790d10b4ed9346a93b23b4f4f713a912a85
-
C:\Users\Admin\33920049\run.vbsMD5
cf89b541a473227459c4641e6a8295a4
SHA134f155a33e7e412419707791b3a8b07bfc234421
SHA256bbb9a6522209e63d480a0de5b498f48fd16945f32c80a42c7c8da1d992f676c7
SHA51200207ab418361584e4afd9a7048fc86dea607400103a6962303bf10e0ad351383fccae32fd0524a0ca3eb732325636de16cad46b710c4fd676c9fd3cb37a2421
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp3E8C.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
memory/704-136-0x0000000000000000-mapping.dmp
-
memory/1284-115-0x0000000000000000-mapping.dmp
-
memory/1804-135-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/1804-126-0x0000000000F1E792-mapping.dmp
-
memory/1804-131-0x0000000005ED0000-0x0000000005ED1000-memory.dmpFilesize
4KB
-
memory/1804-132-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/1804-133-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/1804-134-0x00000000059D0000-0x0000000005ECE000-memory.dmpFilesize
5.0MB
-
memory/1804-125-0x0000000000F00000-0x00000000013BE000-memory.dmpFilesize
4.7MB
-
memory/1804-138-0x0000000005EB0000-0x0000000005EB5000-memory.dmpFilesize
20KB
-
memory/1804-139-0x00000000069D0000-0x00000000069E9000-memory.dmpFilesize
100KB
-
memory/1804-140-0x0000000005EC0000-0x0000000005EC3000-memory.dmpFilesize
12KB
-
memory/1828-121-0x0000000000000000-mapping.dmp
-
memory/2588-123-0x0000000000000000-mapping.dmp