Analysis
-
max time kernel
149s -
max time network
170s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
18-10-2021 20:10
Static task
static1
Behavioral task
behavioral1
Sample
70cb56c6c5c12806d8ab9ec9cb9f9721.exe
Resource
win7-en-20210920
General
-
Target
70cb56c6c5c12806d8ab9ec9cb9f9721.exe
-
Size
1.1MB
-
MD5
70cb56c6c5c12806d8ab9ec9cb9f9721
-
SHA1
9f112cd0766ee8fc0cb64506de3549aad9d75625
-
SHA256
4838766d4fa1bd049a8d49f32865f1ef93a56b0ffd5f5fe4fb3401e6329ade0c
-
SHA512
03725f2203b53e0d3bb0ed491929f3c6bb632712ecde91a8c312cad61598ef7ee64ef6cb87a5157381a3dba138a7dc5a1957707bcbdb1bd52a57c8249d80cd60
Malware Config
Extracted
nanocore
1.2.2.0
ezeani.duckdns.org:8338
194.5.98.48:8338
d015a44c-6cf4-4669-a736-929e0fa74f7d
-
activate_away_mode
true
-
backup_connection_host
194.5.98.48
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-30T11:54:13.478924636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8338
-
default_group
OCT
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
d015a44c-6cf4-4669-a736-929e0fa74f7d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
ezeani.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
fmgmfohkw.pifRegSvcs.exepid process 320 fmgmfohkw.pif 1300 RegSvcs.exe -
Loads dropped DLL 5 IoCs
Processes:
70cb56c6c5c12806d8ab9ec9cb9f9721.exefmgmfohkw.pifpid process 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe 320 fmgmfohkw.pif -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fmgmfohkw.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run fmgmfohkw.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows element = "C:\\Users\\Admin\\00902944\\FMGMFO~1.PIF C:\\Users\\Admin\\00902944\\smjodro.ubd" fmgmfohkw.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fmgmfohkw.pifdescription pid process target process PID 320 set thread context of 1300 320 fmgmfohkw.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fmgmfohkw.pifRegSvcs.exepid process 320 fmgmfohkw.pif 320 fmgmfohkw.pif 1300 RegSvcs.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 1300 RegSvcs.exe 1300 RegSvcs.exe 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif 320 fmgmfohkw.pif -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1300 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1300 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
70cb56c6c5c12806d8ab9ec9cb9f9721.exefmgmfohkw.pifRegSvcs.exedescription pid process target process PID 1268 wrote to memory of 320 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe fmgmfohkw.pif PID 1268 wrote to memory of 320 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe fmgmfohkw.pif PID 1268 wrote to memory of 320 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe fmgmfohkw.pif PID 1268 wrote to memory of 320 1268 70cb56c6c5c12806d8ab9ec9cb9f9721.exe fmgmfohkw.pif PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 320 wrote to memory of 1300 320 fmgmfohkw.pif RegSvcs.exe PID 1300 wrote to memory of 2036 1300 RegSvcs.exe schtasks.exe PID 1300 wrote to memory of 2036 1300 RegSvcs.exe schtasks.exe PID 1300 wrote to memory of 2036 1300 RegSvcs.exe schtasks.exe PID 1300 wrote to memory of 2036 1300 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70cb56c6c5c12806d8ab9ec9cb9f9721.exe"C:\Users\Admin\AppData\Local\Temp\70cb56c6c5c12806d8ab9ec9cb9f9721.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\00902944\fmgmfohkw.pif"C:\Users\Admin\00902944\fmgmfohkw.pif" smjodro.ubd2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4DA3.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\00902944\fmgmfohkw.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
C:\Users\Admin\00902944\mihirbsn.swjMD5
2471d4f94b2d7c5eae622064ef6bd072
SHA13b5e649b32e5b10ddd33b1785141e3d682ea11b7
SHA2568ec8b0de14d6fa2a08e2c9fc8bae1a1d4ca00e5c4948b02f0c56105a8252af86
SHA512e5cad0a00b306f9b273d21d505ddfe1d0fd6f0840110508186085dcfb0c6aff8b5b1cf2c2e8bded1adc58418d960ca40e7bfbfc309f58a0292a45fd3d113461c
-
C:\Users\Admin\00902944\smjodro.ubdMD5
26ae67ecd17c9c7bbbda7d1343975991
SHA1b6935195fc15be693ec2bfc7f509a646c22dd53a
SHA25692b478bb54d9c9349a961b053313299b8199624800f5b7610c214b6e23fb7d68
SHA512e13a1b373191cf25d66e655c52d0d18989d5924074693259c1c6ab2173345e6b1618972e66db2b00f2f5af29315145330a192bb453e298a09d1b33f782c911d2
-
C:\Users\Admin\00902944\tqbinrnv.dllMD5
0d34d3d5ccffb912ab9a30b282691dfc
SHA1b5a6851ebf05b2a27e2e76288b694caa041fc579
SHA25657d4ce6b51ebe7600527cbe47b3d35024472089cbce4d77d4370386b1b955249
SHA5127da8e7f956e31474579c5eb2085c61bf88a97406991903a6ccbd1323640c8a983d1e97f9d69d74739f417219c15cb1f9068fa3c970ee5a8cd0fb1936575d8d89
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp4DA3.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
\Users\Admin\00902944\fmgmfohkw.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\00902944\fmgmfohkw.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\00902944\fmgmfohkw.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\00902944\fmgmfohkw.pifMD5
8e699954f6b5d64683412cc560938507
SHA18ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA256c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
SHA51213035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/320-59-0x0000000000000000-mapping.dmp
-
memory/1268-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1300-67-0x00000000003D0000-0x00000000008C0000-memory.dmpFilesize
4.9MB
-
memory/1300-68-0x00000000003EE792-mapping.dmp
-
memory/1300-66-0x00000000003D0000-0x00000000008C0000-memory.dmpFilesize
4.9MB
-
memory/1300-71-0x00000000003D0000-0x00000000008C0000-memory.dmpFilesize
4.9MB
-
memory/1300-73-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/1300-76-0x0000000000930000-0x0000000000935000-memory.dmpFilesize
20KB
-
memory/1300-77-0x0000000000A40000-0x0000000000A59000-memory.dmpFilesize
100KB
-
memory/1300-78-0x0000000000AA0000-0x0000000000AA3000-memory.dmpFilesize
12KB
-
memory/2036-74-0x0000000000000000-mapping.dmp