Analysis
-
max time kernel
296s -
max time network
302s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 03:38
Static task
static1
Behavioral task
behavioral1
Sample
PO-13916654658867654342003.exe
Resource
win7-en-20210920
General
-
Target
PO-13916654658867654342003.exe
-
Size
574KB
-
MD5
7ae160bfca29e0c7c3fb4a98a29b32d7
-
SHA1
49d5ca7f388c754d7f8a2723f154cf04a849487c
-
SHA256
f18fe72903701dbb74e8c8baadac476f740cd30fb6643e79a2320d168e7835c6
-
SHA512
1f7fe7428879702e4cac93e0fbd7075dd6839835b877bf075f5538c2593fee51352ca15bec7e811b64a8349d03669b11b1ae38933a071d6fb6c9655b77452713
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.229:60006
neoncorex.duckdns.org:60006
1d5c6a3e-60c1-4684-aee7-fbdc0338bfa0
-
activate_away_mode
true
-
backup_connection_host
neoncorex.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-29T18:43:26.772131836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
60006
-
default_group
NANOSHIELD
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1d5c6a3e-60c1-4684-aee7-fbdc0338bfa0
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.229
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
dwrninstall.exedwrninstall.exepid process 1752 dwrninstall.exe 952 dwrninstall.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-13916654658867654342003.exedwrninstall.exedwrninstall.exedescription pid process target process PID 2024 set thread context of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 1752 set thread context of 1640 1752 dwrninstall.exe RegAsm.exe PID 952 set thread context of 740 952 dwrninstall.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 952 schtasks.exe 668 schtasks.exe 1556 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 472 RegAsm.exe 472 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 472 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO-13916654658867654342003.exeRegAsm.exedwrninstall.exedwrninstall.exedescription pid process Token: SeDebugPrivilege 2024 PO-13916654658867654342003.exe Token: SeDebugPrivilege 472 RegAsm.exe Token: SeDebugPrivilege 1752 dwrninstall.exe Token: SeDebugPrivilege 952 dwrninstall.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
PO-13916654658867654342003.execmd.exetaskeng.exedwrninstall.execmd.exedwrninstall.exedescription pid process target process PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 472 2024 PO-13916654658867654342003.exe RegAsm.exe PID 2024 wrote to memory of 1308 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 1308 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 1308 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 1308 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 880 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 880 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 880 2024 PO-13916654658867654342003.exe cmd.exe PID 2024 wrote to memory of 880 2024 PO-13916654658867654342003.exe cmd.exe PID 1308 wrote to memory of 952 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 952 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 952 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 952 1308 cmd.exe schtasks.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 1752 1740 taskeng.exe dwrninstall.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1640 1752 dwrninstall.exe RegAsm.exe PID 1752 wrote to memory of 1676 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 1676 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 1676 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 1676 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 572 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 572 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 572 1752 dwrninstall.exe cmd.exe PID 1752 wrote to memory of 572 1752 dwrninstall.exe cmd.exe PID 1676 wrote to memory of 668 1676 cmd.exe schtasks.exe PID 1676 wrote to memory of 668 1676 cmd.exe schtasks.exe PID 1676 wrote to memory of 668 1676 cmd.exe schtasks.exe PID 1676 wrote to memory of 668 1676 cmd.exe schtasks.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 1740 wrote to memory of 952 1740 taskeng.exe dwrninstall.exe PID 952 wrote to memory of 740 952 dwrninstall.exe RegAsm.exe PID 952 wrote to memory of 740 952 dwrninstall.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342003.exe"C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342003.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342003.exe" "C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {9CE1AAE5-9B16-4BE9-BDA4-183F55B9FB20} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exeC:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe" "C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exeC:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe" "C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exeMD5
7ae160bfca29e0c7c3fb4a98a29b32d7
SHA149d5ca7f388c754d7f8a2723f154cf04a849487c
SHA256f18fe72903701dbb74e8c8baadac476f740cd30fb6643e79a2320d168e7835c6
SHA5121f7fe7428879702e4cac93e0fbd7075dd6839835b877bf075f5538c2593fee51352ca15bec7e811b64a8349d03669b11b1ae38933a071d6fb6c9655b77452713
-
C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exeMD5
7ae160bfca29e0c7c3fb4a98a29b32d7
SHA149d5ca7f388c754d7f8a2723f154cf04a849487c
SHA256f18fe72903701dbb74e8c8baadac476f740cd30fb6643e79a2320d168e7835c6
SHA5121f7fe7428879702e4cac93e0fbd7075dd6839835b877bf075f5538c2593fee51352ca15bec7e811b64a8349d03669b11b1ae38933a071d6fb6c9655b77452713
-
C:\Users\Admin\AppData\Roaming\dwrninstall\dwrninstall.exeMD5
7ae160bfca29e0c7c3fb4a98a29b32d7
SHA149d5ca7f388c754d7f8a2723f154cf04a849487c
SHA256f18fe72903701dbb74e8c8baadac476f740cd30fb6643e79a2320d168e7835c6
SHA5121f7fe7428879702e4cac93e0fbd7075dd6839835b877bf075f5538c2593fee51352ca15bec7e811b64a8349d03669b11b1ae38933a071d6fb6c9655b77452713
-
memory/472-69-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/472-58-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-59-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-61-0x000000000041E792-mapping.dmp
-
memory/472-62-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-65-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-68-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-57-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-56-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/472-79-0x0000000004D45000-0x0000000004D56000-memory.dmpFilesize
68KB
-
memory/472-71-0x0000000000090000-0x0000000000092000-memory.dmpFilesize
8KB
-
memory/472-78-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/472-75-0x0000000000620000-0x0000000000625000-memory.dmpFilesize
20KB
-
memory/472-76-0x0000000000680000-0x0000000000699000-memory.dmpFilesize
100KB
-
memory/472-77-0x00000000006A0000-0x00000000006A3000-memory.dmpFilesize
12KB
-
memory/572-96-0x0000000000000000-mapping.dmp
-
memory/668-97-0x0000000000000000-mapping.dmp
-
memory/740-116-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/740-109-0x000000000041E792-mapping.dmp
-
memory/880-73-0x0000000000000000-mapping.dmp
-
memory/952-74-0x0000000000000000-mapping.dmp
-
memory/952-103-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/952-101-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/952-99-0x0000000000000000-mapping.dmp
-
memory/1208-114-0x0000000000000000-mapping.dmp
-
memory/1308-70-0x0000000000000000-mapping.dmp
-
memory/1556-115-0x0000000000000000-mapping.dmp
-
memory/1560-113-0x0000000000000000-mapping.dmp
-
memory/1640-98-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/1640-91-0x000000000041E792-mapping.dmp
-
memory/1640-90-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1640-94-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1676-93-0x0000000000000000-mapping.dmp
-
memory/1752-83-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1752-85-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/1752-81-0x0000000000000000-mapping.dmp
-
memory/2024-55-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/2024-53-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB