Analysis
-
max time kernel
302s -
max time network
299s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 14:52
Static task
static1
Behavioral task
behavioral1
Sample
PO-13916654658867654342002.exe
Resource
win7-en-20210920
General
-
Target
PO-13916654658867654342002.exe
-
Size
479KB
-
MD5
6102daa4935e016dea8dc3eec27d2ac1
-
SHA1
c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca
-
SHA256
5d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce
-
SHA512
92d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.229:60006
neoncorex.duckdns.org:60006
1d5c6a3e-60c1-4684-aee7-fbdc0338bfa0
-
activate_away_mode
true
-
backup_connection_host
neoncorex.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-29T18:43:26.772131836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
60006
-
default_group
NANOSHIELD
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1d5c6a3e-60c1-4684-aee7-fbdc0338bfa0
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.229
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
dllinstallprint.exedllinstallprint.exepid process 2200 dllinstallprint.exe 3604 dllinstallprint.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-13916654658867654342002.exedllinstallprint.exedllinstallprint.exedescription pid process target process PID 1812 set thread context of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 2200 set thread context of 1768 2200 dllinstallprint.exe RegAsm.exe PID 3604 set thread context of 1420 3604 dllinstallprint.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3280 schtasks.exe 616 schtasks.exe 3096 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 3456 RegAsm.exe 3456 RegAsm.exe 3456 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 3456 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO-13916654658867654342002.exeRegAsm.exedllinstallprint.exedllinstallprint.exedescription pid process Token: SeDebugPrivilege 1812 PO-13916654658867654342002.exe Token: SeDebugPrivilege 3456 RegAsm.exe Token: SeDebugPrivilege 2200 dllinstallprint.exe Token: SeDebugPrivilege 3604 dllinstallprint.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
PO-13916654658867654342002.execmd.exedllinstallprint.execmd.exedllinstallprint.execmd.exedescription pid process target process PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 3456 1812 PO-13916654658867654342002.exe RegAsm.exe PID 1812 wrote to memory of 2896 1812 PO-13916654658867654342002.exe cmd.exe PID 1812 wrote to memory of 2896 1812 PO-13916654658867654342002.exe cmd.exe PID 1812 wrote to memory of 2896 1812 PO-13916654658867654342002.exe cmd.exe PID 1812 wrote to memory of 3764 1812 PO-13916654658867654342002.exe cmd.exe PID 1812 wrote to memory of 3764 1812 PO-13916654658867654342002.exe cmd.exe PID 1812 wrote to memory of 3764 1812 PO-13916654658867654342002.exe cmd.exe PID 2896 wrote to memory of 616 2896 cmd.exe schtasks.exe PID 2896 wrote to memory of 616 2896 cmd.exe schtasks.exe PID 2896 wrote to memory of 616 2896 cmd.exe schtasks.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 1768 2200 dllinstallprint.exe RegAsm.exe PID 2200 wrote to memory of 2088 2200 dllinstallprint.exe cmd.exe PID 2200 wrote to memory of 2088 2200 dllinstallprint.exe cmd.exe PID 2200 wrote to memory of 2088 2200 dllinstallprint.exe cmd.exe PID 2200 wrote to memory of 1724 2200 dllinstallprint.exe cmd.exe PID 2200 wrote to memory of 1724 2200 dllinstallprint.exe cmd.exe PID 2200 wrote to memory of 1724 2200 dllinstallprint.exe cmd.exe PID 2088 wrote to memory of 3096 2088 cmd.exe schtasks.exe PID 2088 wrote to memory of 3096 2088 cmd.exe schtasks.exe PID 2088 wrote to memory of 3096 2088 cmd.exe schtasks.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 1420 3604 dllinstallprint.exe RegAsm.exe PID 3604 wrote to memory of 2352 3604 dllinstallprint.exe cmd.exe PID 3604 wrote to memory of 2352 3604 dllinstallprint.exe cmd.exe PID 3604 wrote to memory of 2352 3604 dllinstallprint.exe cmd.exe PID 3604 wrote to memory of 1820 3604 dllinstallprint.exe cmd.exe PID 3604 wrote to memory of 1820 3604 dllinstallprint.exe cmd.exe PID 3604 wrote to memory of 1820 3604 dllinstallprint.exe cmd.exe PID 2352 wrote to memory of 3280 2352 cmd.exe schtasks.exe PID 2352 wrote to memory of 3280 2352 cmd.exe schtasks.exe PID 2352 wrote to memory of 3280 2352 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342002.exe"C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342002.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342002.exe" "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exeC:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe" "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exeC:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe" "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logMD5
c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dllinstallprint.exe.logMD5
7ffb997d789655f20c977dd932150653
SHA1ddea3eb28fe069e99327ed7ac3ad089dcae3fc59
SHA256d6532c4017d9cb6d1c74dcec7a255944c4099d68de37d8c88f0f72bf232a7ad3
SHA51215801c094a49d541de42ebeee41d8f2bf9f16e5b443cdfe221ea1d8e83d23882bb897e8757f52fd43f8c403eea847f893709c21110930d2856c2a00bfe1425c2
-
C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exeMD5
6102daa4935e016dea8dc3eec27d2ac1
SHA1c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca
SHA2565d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce
SHA51292d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51
-
C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exeMD5
6102daa4935e016dea8dc3eec27d2ac1
SHA1c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca
SHA2565d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce
SHA51292d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51
-
C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exeMD5
6102daa4935e016dea8dc3eec27d2ac1
SHA1c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca
SHA2565d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce
SHA51292d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51
-
memory/616-131-0x0000000000000000-mapping.dmp
-
memory/1420-177-0x0000000004AC0000-0x0000000004FBE000-memory.dmpFilesize
5.0MB
-
memory/1420-166-0x000000000041E792-mapping.dmp
-
memory/1724-153-0x0000000000000000-mapping.dmp
-
memory/1768-156-0x0000000005470000-0x000000000596E000-memory.dmpFilesize
5.0MB
-
memory/1768-146-0x000000000041E792-mapping.dmp
-
memory/1812-117-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/1812-118-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/1812-119-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/1812-120-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/1812-115-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB
-
memory/1820-174-0x0000000000000000-mapping.dmp
-
memory/2088-152-0x0000000000000000-mapping.dmp
-
memory/2200-139-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2200-144-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/2352-173-0x0000000000000000-mapping.dmp
-
memory/2896-129-0x0000000000000000-mapping.dmp
-
memory/3096-154-0x0000000000000000-mapping.dmp
-
memory/3280-176-0x0000000000000000-mapping.dmp
-
memory/3456-122-0x000000000041E792-mapping.dmp
-
memory/3456-127-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3456-121-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3456-135-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/3456-136-0x0000000004C53000-0x0000000004C55000-memory.dmpFilesize
8KB
-
memory/3456-134-0x0000000005AE0000-0x0000000005AE3000-memory.dmpFilesize
12KB
-
memory/3456-133-0x0000000005270000-0x0000000005289000-memory.dmpFilesize
100KB
-
memory/3456-132-0x0000000005040000-0x0000000005045000-memory.dmpFilesize
20KB
-
memory/3604-164-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/3764-130-0x0000000000000000-mapping.dmp