Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 09:39
Static task
static1
Behavioral task
behavioral1
Sample
8117737f7e9cedfbf913defe3c7a9b500e64c336.exe
Resource
win7-en-20210920
General
-
Target
8117737f7e9cedfbf913defe3c7a9b500e64c336.exe
-
Size
393KB
-
MD5
457f8a3ee875eeb4268d3d6c0d58c75b
-
SHA1
8117737f7e9cedfbf913defe3c7a9b500e64c336
-
SHA256
a9b0570add0adde07d7a99817e23fdc79d0e66b98441184d2362bced6468c70f
-
SHA512
d1a1723ec9ef98b81b4eae65e7037a891e3d0a8e51d026bad5e6b61c88e8224d5339c49942beb31d01ce4e148eaa2a7b1eafc20756e2152ed497c3328c4c3d40
Malware Config
Extracted
nanocore
1.2.2.0
1116.hopto.org:1116
185.140.53.9:1116
909dcd33-e0d7-4bd0-87b2-b7fd2611b6b9
-
activate_away_mode
true
-
backup_connection_host
185.140.53.9
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-02-16T08:43:19.524585136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1116
-
default_group
1116
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
909dcd33-e0d7-4bd0-87b2-b7fd2611b6b9
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
1116.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8117737f7e9cedfbf913defe3c7a9b500e64c336.exedescription pid process target process PID 2056 set thread context of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe RegSvcs.exe File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1188 schtasks.exe 3264 schtasks.exe 360 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
8117737f7e9cedfbf913defe3c7a9b500e64c336.exeRegSvcs.exepid process 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2584 RegSvcs.exe 2584 RegSvcs.exe 2584 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2584 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8117737f7e9cedfbf913defe3c7a9b500e64c336.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe Token: SeDebugPrivilege 2584 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8117737f7e9cedfbf913defe3c7a9b500e64c336.exepid process 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
8117737f7e9cedfbf913defe3c7a9b500e64c336.exeRegSvcs.exedescription pid process target process PID 2056 wrote to memory of 3264 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe schtasks.exe PID 2056 wrote to memory of 3264 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe schtasks.exe PID 2056 wrote to memory of 3264 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe schtasks.exe PID 2056 wrote to memory of 1788 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 1788 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 1788 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2056 wrote to memory of 2584 2056 8117737f7e9cedfbf913defe3c7a9b500e64c336.exe RegSvcs.exe PID 2584 wrote to memory of 360 2584 RegSvcs.exe schtasks.exe PID 2584 wrote to memory of 360 2584 RegSvcs.exe schtasks.exe PID 2584 wrote to memory of 360 2584 RegSvcs.exe schtasks.exe PID 2584 wrote to memory of 1188 2584 RegSvcs.exe schtasks.exe PID 2584 wrote to memory of 1188 2584 RegSvcs.exe schtasks.exe PID 2584 wrote to memory of 1188 2584 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8117737f7e9cedfbf913defe3c7a9b500e64c336.exe"C:\Users\Admin\AppData\Local\Temp\8117737f7e9cedfbf913defe3c7a9b500e64c336.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QWePiWcEeQTcx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D0C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8681.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp87BB.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8681.tmpMD5
8cad1b41587ced0f1e74396794f31d58
SHA111054bf74fcf5e8e412768035e4dae43aa7b710f
SHA2563086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c
SHA51299c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef
-
C:\Users\Admin\AppData\Local\Temp\tmp87BB.tmpMD5
b3b017f9df206021717a11f11d895402
SHA1e4ea12823af6550ee634536eec1eb14490580a3b
SHA256654dfce2c28024364e679e1b958f3fb81fc6d29685d534d905d1c83a84351024
SHA51295666cb81aa1fd1ade04a32f63381ce8bff274d7d300c0b59cbb10a294c4d1eebaa3000365a2000b38793de030044995cf23e623c5e3648d9b00501f97ff9343
-
memory/360-136-0x0000000000000000-mapping.dmp
-
memory/1188-138-0x0000000000000000-mapping.dmp
-
memory/2056-121-0x0000000004F40000-0x000000000543E000-memory.dmpFilesize
5.0MB
-
memory/2056-117-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/2056-122-0x0000000004F40000-0x000000000543E000-memory.dmpFilesize
5.0MB
-
memory/2056-123-0x00000000091C0000-0x00000000091C8000-memory.dmpFilesize
32KB
-
memory/2056-124-0x0000000009280000-0x0000000009281000-memory.dmpFilesize
4KB
-
memory/2056-125-0x0000000009320000-0x0000000009375000-memory.dmpFilesize
340KB
-
memory/2056-115-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/2056-118-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/2056-119-0x0000000004F40000-0x000000000543E000-memory.dmpFilesize
5.0MB
-
memory/2056-120-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/2584-135-0x0000000005100000-0x00000000055FE000-memory.dmpFilesize
5.0MB
-
memory/2584-128-0x000000000041E792-mapping.dmp
-
memory/2584-127-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2584-140-0x00000000053D0000-0x00000000053D5000-memory.dmpFilesize
20KB
-
memory/2584-141-0x00000000060F0000-0x0000000006109000-memory.dmpFilesize
100KB
-
memory/2584-142-0x0000000006320000-0x0000000006323000-memory.dmpFilesize
12KB
-
memory/2584-143-0x0000000005100000-0x00000000055FE000-memory.dmpFilesize
5.0MB
-
memory/3264-126-0x0000000000000000-mapping.dmp