Analysis
-
max time kernel
146s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 21:26
Static task
static1
General
-
Target
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe
-
Size
537KB
-
MD5
722745a1b594b935445310f8b4f0b9af
-
SHA1
2945a2c49a0f0978560b5272ce9ddfbf44855fc8
-
SHA256
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e
-
SHA512
f571211c33c3739cbe26ae6b694d62aebf86a169f8f22f01a19c802323ad8ce143b1c7f0d8f062d478ad976ef5277ae485619c95711c852455abef8de436e35e
Malware Config
Extracted
nanocore
1.2.2.0
drrkingsleym001.ddns.net:1665
70bb352e-dceb-4105-9fdd-010e83e28b1b
-
activate_away_mode
true
-
backup_connection_host
drrkingsleym001.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-31T04:41:53.700956836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NEW LIFE
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
70bb352e-dceb-4105-9fdd-010e83e28b1b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
drrkingsleym001.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exedescription pid process target process PID 1008 set thread context of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 60 schtasks.exe 644 schtasks.exe 2460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exeRegSvcs.exepid process 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe 1240 RegSvcs.exe 1240 RegSvcs.exe 1240 RegSvcs.exe 1240 RegSvcs.exe 1240 RegSvcs.exe 1240 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1240 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe Token: SeDebugPrivilege 1240 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exeRegSvcs.exedescription pid process target process PID 1008 wrote to memory of 644 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe schtasks.exe PID 1008 wrote to memory of 644 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe schtasks.exe PID 1008 wrote to memory of 644 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe schtasks.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1008 wrote to memory of 1240 1008 dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe RegSvcs.exe PID 1240 wrote to memory of 2460 1240 RegSvcs.exe schtasks.exe PID 1240 wrote to memory of 2460 1240 RegSvcs.exe schtasks.exe PID 1240 wrote to memory of 2460 1240 RegSvcs.exe schtasks.exe PID 1240 wrote to memory of 60 1240 RegSvcs.exe schtasks.exe PID 1240 wrote to memory of 60 1240 RegSvcs.exe schtasks.exe PID 1240 wrote to memory of 60 1240 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe"C:\Users\Admin\AppData\Local\Temp\dae8f3e0c1152d769be3a1951287cfe91c365f60c4bd772b2dec8686f52c167e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iGlXinw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C0B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp21D7.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2274.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp21D7.tmpMD5
40b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp2274.tmpMD5
b3b017f9df206021717a11f11d895402
SHA1e4ea12823af6550ee634536eec1eb14490580a3b
SHA256654dfce2c28024364e679e1b958f3fb81fc6d29685d534d905d1c83a84351024
SHA51295666cb81aa1fd1ade04a32f63381ce8bff274d7d300c0b59cbb10a294c4d1eebaa3000365a2000b38793de030044995cf23e623c5e3648d9b00501f97ff9343
-
memory/60-122-0x0000000000000000-mapping.dmp
-
memory/644-116-0x0000000000000000-mapping.dmp
-
memory/1008-115-0x0000000002D90000-0x0000000002D91000-memory.dmpFilesize
4KB
-
memory/1240-117-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1240-118-0x000000000041E792-mapping.dmp
-
memory/1240-121-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/1240-124-0x0000000002921000-0x0000000002922000-memory.dmpFilesize
4KB
-
memory/2460-119-0x0000000000000000-mapping.dmp