Analysis
-
max time kernel
149s -
max time network
179s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 01:34
Static task
static1
Behavioral task
behavioral1
Sample
KERSEL00000209419.scr
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
KERSEL00000209419.scr
Resource
win10-en-20211014
General
-
Target
KERSEL00000209419.scr
-
Size
976KB
-
MD5
f9ddb4afd10f811f82d3efc7335a3899
-
SHA1
7132e4e6d07df37905950ef8d92f38b12ae4832e
-
SHA256
f7b6fe9f584bc1662bf71f4baa1a242edfe7d823eb1538f24065fd9094e9b02f
-
SHA512
a172061299d4b7ec2d54e32379f4e2156e0176964282b481acfd354993bddca979e5a98335b9905572de4c4ac8b5ab56b3743daff690f89933b9248a4eeec2ab
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:48562
185.19.85.175:48562
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
activate_away_mode
false
-
backup_connection_host
185.19.85.175
- backup_dns_server
-
buffer_size
65538
-
build_time
2021-04-20T00:12:13.961451136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
48562
-
default_group
HOBBIT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
oamjouuda.pifRegSvcs.exepid process 1540 oamjouuda.pif 1348 RegSvcs.exe -
Loads dropped DLL 5 IoCs
Processes:
KERSEL00000209419.scroamjouuda.pifpid process 548 KERSEL00000209419.scr 548 KERSEL00000209419.scr 548 KERSEL00000209419.scr 548 KERSEL00000209419.scr 1540 oamjouuda.pif -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
oamjouuda.pifRegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29006555\\OAMJOU~1.PIF C:\\Users\\Admin\\AppData\\Local\\Temp\\29006555\\QGXXHB~1.FAK" oamjouuda.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29006555\\Update.vbs" oamjouuda.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run oamjouuda.pif -
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
oamjouuda.pifdescription pid process target process PID 1540 set thread context of 1348 1540 oamjouuda.pif RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\UDP Subsystem\udpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1408 schtasks.exe 1828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegSvcs.exepid process 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1348 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1348 RegSvcs.exe Token: SeDebugPrivilege 1348 RegSvcs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
KERSEL00000209419.scroamjouuda.pifRegSvcs.exedescription pid process target process PID 548 wrote to memory of 1540 548 KERSEL00000209419.scr oamjouuda.pif PID 548 wrote to memory of 1540 548 KERSEL00000209419.scr oamjouuda.pif PID 548 wrote to memory of 1540 548 KERSEL00000209419.scr oamjouuda.pif PID 548 wrote to memory of 1540 548 KERSEL00000209419.scr oamjouuda.pif PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1540 wrote to memory of 1348 1540 oamjouuda.pif RegSvcs.exe PID 1348 wrote to memory of 1828 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1828 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1828 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1828 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1408 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1408 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1408 1348 RegSvcs.exe schtasks.exe PID 1348 wrote to memory of 1408 1348 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KERSEL00000209419.scr"C:\Users\Admin\AppData\Local\Temp\KERSEL00000209419.scr" /S1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pif"C:\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pif" qgxxhbeeur.fak2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6B31.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6EFA.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pifMD5
e1f85da023a9f5784e38a37c16c777e6
SHA16623fe6bb1903311cfa96ebdcd25822bc4f221ef
SHA256f4ca36a5e6c02acd6897ffdcaed69f1767ff05a99b2042b218171886b88af162
SHA51228e0a435eb27ca8653a767383a8b16d13f9c0f37e93a4dc814da02ad21c2e85f2efd9df80915437a4768dbe5b107741ba9451754f479340dfc6db2e7b15d55ba
-
C:\Users\Admin\AppData\Local\Temp\29006555\ofpfg.oigMD5
9623d2ac778e54910fa04dee5c900f69
SHA14a320ad98158212744e5fcc80d083e650dee7579
SHA256a334e4f7292f1c408dfdd959d84742ad687f3d3f40e1353fa11d573df3376cad
SHA512fc3a1bbd1ded2d0598b0533cd7c1a999ee190dbf4266a8c35ae51854d6dd24c0bc196facd75cd45851b84e278a39a4e942be178080223c8ca23d7671429a9e58
-
C:\Users\Admin\AppData\Local\Temp\29006555\qgxxhbeeur.fakMD5
e97cf2e2c846376c9c4ab3fdfac89f95
SHA1656e71c64683f48225b8cdcd99cc0f6f3211c779
SHA256d881f2b9431e91a0189876c53aaa7123ca9ad9edf2f0342b5224a2411f7d83c1
SHA512b9cf1bbacf21b71d4a9d7e96c61d76fd0384d56a74e0778e0967e7fa571581f6c9d732b6e49f197d76129eb79504b0950bc40f1131677b61b6825bb785d37ec7
-
C:\Users\Admin\AppData\Local\Temp\29006555\rvuvtxmop.icmMD5
c8fdfb013b07f4473850c70b5c1bcb4a
SHA14a0ff8d1700da6bfa49c607f593b376749120178
SHA2567e2c6b66af2bd95c733339ca37adc4245e5356ea3aad98597a6c762e81ee3f81
SHA512adfc149c9dc84e1cef29dda6308b4f03118a7b36a4d67b638ed36eb453269396ab0978de6068e689f5af6335362cb9dc98b3aa2daf96fb3cbdc70dd8288f7cc6
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\tmp6B31.tmpMD5
95aceabc58acad5d73372b0966ee1b35
SHA12293b7ad4793cf574b1a5220e85f329b5601040a
SHA2568d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
SHA51200760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
-
C:\Users\Admin\AppData\Local\Temp\tmp6EFA.tmpMD5
c4aecdef99eba873119e79616df3f4b0
SHA1b1b3af52655fb633eed909dfed05b64fbbfac37c
SHA25624fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b
SHA512e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4
-
\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pifMD5
e1f85da023a9f5784e38a37c16c777e6
SHA16623fe6bb1903311cfa96ebdcd25822bc4f221ef
SHA256f4ca36a5e6c02acd6897ffdcaed69f1767ff05a99b2042b218171886b88af162
SHA51228e0a435eb27ca8653a767383a8b16d13f9c0f37e93a4dc814da02ad21c2e85f2efd9df80915437a4768dbe5b107741ba9451754f479340dfc6db2e7b15d55ba
-
\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pifMD5
e1f85da023a9f5784e38a37c16c777e6
SHA16623fe6bb1903311cfa96ebdcd25822bc4f221ef
SHA256f4ca36a5e6c02acd6897ffdcaed69f1767ff05a99b2042b218171886b88af162
SHA51228e0a435eb27ca8653a767383a8b16d13f9c0f37e93a4dc814da02ad21c2e85f2efd9df80915437a4768dbe5b107741ba9451754f479340dfc6db2e7b15d55ba
-
\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pifMD5
e1f85da023a9f5784e38a37c16c777e6
SHA16623fe6bb1903311cfa96ebdcd25822bc4f221ef
SHA256f4ca36a5e6c02acd6897ffdcaed69f1767ff05a99b2042b218171886b88af162
SHA51228e0a435eb27ca8653a767383a8b16d13f9c0f37e93a4dc814da02ad21c2e85f2efd9df80915437a4768dbe5b107741ba9451754f479340dfc6db2e7b15d55ba
-
\Users\Admin\AppData\Local\Temp\29006555\oamjouuda.pifMD5
e1f85da023a9f5784e38a37c16c777e6
SHA16623fe6bb1903311cfa96ebdcd25822bc4f221ef
SHA256f4ca36a5e6c02acd6897ffdcaed69f1767ff05a99b2042b218171886b88af162
SHA51228e0a435eb27ca8653a767383a8b16d13f9c0f37e93a4dc814da02ad21c2e85f2efd9df80915437a4768dbe5b107741ba9451754f479340dfc6db2e7b15d55ba
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/548-54-0x0000000075331000-0x0000000075333000-memory.dmpFilesize
8KB
-
memory/1348-74-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/1348-67-0x0000000000300000-0x00000000007A5000-memory.dmpFilesize
4.6MB
-
memory/1348-71-0x0000000000300000-0x00000000007A5000-memory.dmpFilesize
4.6MB
-
memory/1348-68-0x000000000031E792-mapping.dmp
-
memory/1348-66-0x0000000000300000-0x00000000007A5000-memory.dmpFilesize
4.6MB
-
memory/1348-78-0x0000000000B40000-0x0000000000B45000-memory.dmpFilesize
20KB
-
memory/1348-79-0x0000000000B50000-0x0000000000B56000-memory.dmpFilesize
24KB
-
memory/1348-80-0x00000000022C0000-0x00000000022D9000-memory.dmpFilesize
100KB
-
memory/1348-81-0x00000000023F0000-0x00000000023F3000-memory.dmpFilesize
12KB
-
memory/1408-76-0x0000000000000000-mapping.dmp
-
memory/1540-59-0x0000000000000000-mapping.dmp
-
memory/1828-73-0x0000000000000000-mapping.dmp