Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
23-10-2021 08:00
Static task
static1
Behavioral task
behavioral1
Sample
6b3e2ac8.exe
Resource
win7-en-20211014
General
-
Target
6b3e2ac8.exe
-
Size
359KB
-
MD5
8575cb6fc0f2e03e427b847b8bf734a9
-
SHA1
23f35839198e0cab7822e2fa2ac8e75a3b575291
-
SHA256
6b3e2ac84de7a3c998848636d915108d98ce24a70cddffc483e1681f0210665a
-
SHA512
57690b76b4aef045b92f098253a260b31dc339c32acf7829386c5abf9ec17cf9ea031175ebb53a2794d4701a98732b972be672438c007edd867f1d9f1b6db23e
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.75:97
75237636-ccfc-402a-827d-5ad01371659e
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-24T01:53:34.394429836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
97
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
75237636-ccfc-402a-827d-5ad01371659e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.75
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Service = "C:\\Program Files (x86)\\SMTP Service\\smtpsvc.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6b3e2ac8.exedescription pid process target process PID 1668 set thread context of 1292 1668 6b3e2ac8.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SMTP Service\smtpsvc.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SMTP Service\smtpsvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1288 schtasks.exe 1048 schtasks.exe 1928 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
6b3e2ac8.exeRegSvcs.exepid process 1668 6b3e2ac8.exe 1668 6b3e2ac8.exe 1668 6b3e2ac8.exe 1668 6b3e2ac8.exe 1292 RegSvcs.exe 1292 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1292 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6b3e2ac8.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1668 6b3e2ac8.exe Token: SeDebugPrivilege 1292 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
6b3e2ac8.exeRegSvcs.exedescription pid process target process PID 1668 wrote to memory of 1288 1668 6b3e2ac8.exe schtasks.exe PID 1668 wrote to memory of 1288 1668 6b3e2ac8.exe schtasks.exe PID 1668 wrote to memory of 1288 1668 6b3e2ac8.exe schtasks.exe PID 1668 wrote to memory of 1288 1668 6b3e2ac8.exe schtasks.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1556 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1668 wrote to memory of 1292 1668 6b3e2ac8.exe RegSvcs.exe PID 1292 wrote to memory of 1048 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1048 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1048 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1048 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1928 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1928 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1928 1292 RegSvcs.exe schtasks.exe PID 1292 wrote to memory of 1928 1292 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b3e2ac8.exe"C:\Users\Admin\AppData\Local\Temp\6b3e2ac8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vhHiynSGnoB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9463.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9A2D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9C9E.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9A2D.tmpMD5
40b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp9C9E.tmpMD5
cfae5a3b7d8aa9653fe2512578a0d23a
SHA1a91a2f8daef114f89038925ada6784646a0a5b12
SHA2562ab741415f193a2a9134eac48a2310899d18efb5e61c3e81c35140a7efea30fa
SHA5129dfd7eca6924ae2785ce826a447b6ce6d043c552fbd3b8a804ce6722b07a74900e703dc56cd4443cae9ab9601f21a6068e29771e48497a9ae434096a11814e84
-
memory/1048-67-0x0000000000000000-mapping.dmp
-
memory/1288-58-0x0000000000000000-mapping.dmp
-
memory/1292-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1292-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1292-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1292-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1292-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1292-64-0x000000000041E792-mapping.dmp
-
memory/1292-66-0x0000000002040000-0x0000000002041000-memory.dmpFilesize
4KB
-
memory/1292-71-0x0000000002041000-0x0000000002042000-memory.dmpFilesize
4KB
-
memory/1668-55-0x0000000075C21000-0x0000000075C23000-memory.dmpFilesize
8KB
-
memory/1668-57-0x0000000000D21000-0x0000000000D22000-memory.dmpFilesize
4KB
-
memory/1668-56-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/1928-69-0x0000000000000000-mapping.dmp