Analysis
-
max time kernel
142s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 12:24
Static task
static1
Behavioral task
behavioral1
Sample
e13b24cda6737f13b2dc3f2c20d8823b.exe
Resource
win7-en-20210920
General
-
Target
e13b24cda6737f13b2dc3f2c20d8823b.exe
-
Size
531KB
-
MD5
e13b24cda6737f13b2dc3f2c20d8823b
-
SHA1
b58a2436a4befb5b7465153a72f64fd17531644c
-
SHA256
f8ee546f04fa175fa9a8b1f3de8595bd0a4f6aebfeed50a95c5e309d49063e1e
-
SHA512
c8fd34d209a8659638e349a86fc39f76a11ee0a7a74afb4db479d7c00a6442194a3e3ff9aae41efb6acd065f2cf665342fd523aa19fe69cb95b0178f903b734c
Malware Config
Extracted
nanocore
1.2.2.0
chongmei33.publicvm.com:5569
9b8ed064-d4db-4d21-985f-e3763341fef1
-
activate_away_mode
true
-
backup_connection_host
chongmei33.publicvm.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-27T15:56:15.517725036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5569
-
default_group
OCT
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9b8ed064-d4db-4d21-985f-e3763341fef1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
chongmei33.publicvm.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox = "\"C:\\Users\\Admin\\AppData\\Roaming\\firefox.exe\"" e13b24cda6737f13b2dc3f2c20d8823b.exe -
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e13b24cda6737f13b2dc3f2c20d8823b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exedescription pid process target process PID 1996 set thread context of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exee13b24cda6737f13b2dc3f2c20d8823b.exepid process 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe 4416 e13b24cda6737f13b2dc3f2c20d8823b.exe 4416 e13b24cda6737f13b2dc3f2c20d8823b.exe 4416 e13b24cda6737f13b2dc3f2c20d8823b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exepid process 4416 e13b24cda6737f13b2dc3f2c20d8823b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exee13b24cda6737f13b2dc3f2c20d8823b.exedescription pid process Token: SeDebugPrivilege 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe Token: SeDebugPrivilege 4416 e13b24cda6737f13b2dc3f2c20d8823b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
e13b24cda6737f13b2dc3f2c20d8823b.exedescription pid process target process PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe PID 1996 wrote to memory of 4416 1996 e13b24cda6737f13b2dc3f2c20d8823b.exe e13b24cda6737f13b2dc3f2c20d8823b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e13b24cda6737f13b2dc3f2c20d8823b.exe"C:\Users\Admin\AppData\Local\Temp\e13b24cda6737f13b2dc3f2c20d8823b.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e13b24cda6737f13b2dc3f2c20d8823b.exeC:\Users\Admin\AppData\Local\Temp\e13b24cda6737f13b2dc3f2c20d8823b.exe2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e13b24cda6737f13b2dc3f2c20d8823b.exe.logMD5
4f9330dcb7e8730af9341cfdf0d8030f
SHA167daaf17560b15fe1d861139bce85a3ff6dbed23
SHA2561c25f424605d0e3ccf1ec077c36b3d2c89aa628521d10df851c2ff7689ad4617
SHA512e3becfad18409be0797d172e8b1364775726f9d33d8f125c87656a829b0c0c86fcec433db4446371e68530c0d7cb594fdcf28bb75e1f5d4fba64fe38329d9a40
-
memory/1996-120-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/1996-118-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/1996-119-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/1996-115-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/1996-121-0x00000000050E0000-0x0000000005113000-memory.dmpFilesize
204KB
-
memory/1996-117-0x0000000004CC0000-0x0000000004D26000-memory.dmpFilesize
408KB
-
memory/4416-128-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/4416-122-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4416-123-0x000000000041E792-mapping.dmp
-
memory/4416-129-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/4416-130-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/4416-131-0x0000000004E70000-0x000000000536E000-memory.dmpFilesize
5.0MB
-
memory/4416-132-0x0000000004EF0000-0x0000000004EF5000-memory.dmpFilesize
20KB
-
memory/4416-133-0x0000000005180000-0x0000000005199000-memory.dmpFilesize
100KB
-
memory/4416-134-0x0000000005B60000-0x0000000005B63000-memory.dmpFilesize
12KB