Analysis
-
max time kernel
117s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-10-2021 10:51
Static task
static1
Behavioral task
behavioral1
Sample
Conform descrierii traducereProfil liniar355377.exe
Resource
win7-en-20210920
General
-
Target
Conform descrierii traducereProfil liniar355377.exe
-
Size
300KB
-
MD5
1570be9489f6638e20884ea8b262f0a8
-
SHA1
2f627c510f7fc0808d8e06b9b309f934acb439c0
-
SHA256
abca0434af61ccbf707f5ea013f0c5f582106c9701552eeba5e64d678401dfd2
-
SHA512
5d7651935e4f7ae6923046c4ee70bff0a9f905ae69485af95fd86d09958db5d298323e4de53268d6252861b1039cc52ea393e51999e9b7e148507729e597abca
Malware Config
Extracted
nanocore
1.2.2.0
178.170.138.163:5626
01f9d977-6605-495e-941a-753d3cd6dc0b
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-02-27T13:54:38.807349736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
5626
-
default_group
4Maticross.
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
01f9d977-6605-495e-941a-753d3cd6dc0b
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
178.170.138.163
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Conform descrierii traducereProfil liniar355377.exepid process 3484 Conform descrierii traducereProfil liniar355377.exe -
Processes:
Conform descrierii traducereProfil liniar355377.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Conform descrierii traducereProfil liniar355377.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Conform descrierii traducereProfil liniar355377.exedescription pid process target process PID 3484 set thread context of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Conform descrierii traducereProfil liniar355377.exepid process 800 Conform descrierii traducereProfil liniar355377.exe 800 Conform descrierii traducereProfil liniar355377.exe 800 Conform descrierii traducereProfil liniar355377.exe 800 Conform descrierii traducereProfil liniar355377.exe 800 Conform descrierii traducereProfil liniar355377.exe 800 Conform descrierii traducereProfil liniar355377.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Conform descrierii traducereProfil liniar355377.exepid process 800 Conform descrierii traducereProfil liniar355377.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Conform descrierii traducereProfil liniar355377.exedescription pid process Token: SeDebugPrivilege 800 Conform descrierii traducereProfil liniar355377.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Conform descrierii traducereProfil liniar355377.exedescription pid process target process PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe PID 3484 wrote to memory of 800 3484 Conform descrierii traducereProfil liniar355377.exe Conform descrierii traducereProfil liniar355377.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Conform descrierii traducereProfil liniar355377.exe"C:\Users\Admin\AppData\Local\Temp\Conform descrierii traducereProfil liniar355377.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Conform descrierii traducereProfil liniar355377.exe"C:\Users\Admin\AppData\Local\Temp\Conform descrierii traducereProfil liniar355377.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsqDFB3.tmp\hxgll.dllMD5
6aee0715f2773579719c70bcbd2eddaf
SHA11e378c3e71b2184ce3b0fe97176f9b8c0d3d04df
SHA2563479563cfd7304bb2d59c5b0ce3ec754a0ac915d147a73f8f577e4a5f4c6dcb7
SHA5124aed1dd163ca3454dc6e327a6a2feebae1cfd2da632ec20fca98c85825fc838ae3e318528b5774e65008fd1bcbabb1d0bcf29a1855a5498d555644876521813e
-
memory/800-116-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/800-117-0x000000000040188B-mapping.dmp
-
memory/800-118-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/800-120-0x0000000000A61000-0x0000000000A62000-memory.dmpFilesize
4KB
-
memory/800-119-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/800-121-0x0000000000A62000-0x0000000000A64000-memory.dmpFilesize
8KB
-
memory/800-123-0x0000000000A68000-0x0000000000A69000-memory.dmpFilesize
4KB
-
memory/800-122-0x0000000000A67000-0x0000000000A68000-memory.dmpFilesize
4KB