Analysis
-
max time kernel
120s -
max time network
164s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-10-2021 19:44
Static task
static1
Behavioral task
behavioral1
Sample
ace96cf7ef24eeac993b4da172a5a8f0.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ace96cf7ef24eeac993b4da172a5a8f0.exe
Resource
win10-en-20210920
General
-
Target
ace96cf7ef24eeac993b4da172a5a8f0.exe
-
Size
359KB
-
MD5
ace96cf7ef24eeac993b4da172a5a8f0
-
SHA1
fa89615f55a87ef1d9ee9330ec5b0c040f54e8c1
-
SHA256
d4ee80500d9c280e85b290b467592a5910e9d4ee127cfda17ad40467b2c88942
-
SHA512
e1d5279223d7e82003bad73e94b1607b043c0b987987e99dc39ab9790558c4c840cd6949a37f87134fbd13b64c4a2492fb572eebde870db709d2a77c419c7ea1
Malware Config
Extracted
nanocore
1.2.2.0
drrkingsleym001.ddns.net:1665
70bb352e-dceb-4105-9fdd-010e83e28b1b
-
activate_away_mode
true
-
backup_connection_host
drrkingsleym001.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-31T04:41:53.700956836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NEW LIFE
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
70bb352e-dceb-4105-9fdd-010e83e28b1b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
drrkingsleym001.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ace96cf7ef24eeac993b4da172a5a8f0.exedescription pid process target process PID 836 set thread context of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\UDP Subsystem\udpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1308 schtasks.exe 752 schtasks.exe 1344 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ace96cf7ef24eeac993b4da172a5a8f0.exeRegSvcs.exepid process 836 ace96cf7ef24eeac993b4da172a5a8f0.exe 836 ace96cf7ef24eeac993b4da172a5a8f0.exe 1972 RegSvcs.exe 1972 RegSvcs.exe 1972 RegSvcs.exe 1972 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1972 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ace96cf7ef24eeac993b4da172a5a8f0.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 836 ace96cf7ef24eeac993b4da172a5a8f0.exe Token: SeDebugPrivilege 1972 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ace96cf7ef24eeac993b4da172a5a8f0.exeRegSvcs.exedescription pid process target process PID 836 wrote to memory of 1308 836 ace96cf7ef24eeac993b4da172a5a8f0.exe schtasks.exe PID 836 wrote to memory of 1308 836 ace96cf7ef24eeac993b4da172a5a8f0.exe schtasks.exe PID 836 wrote to memory of 1308 836 ace96cf7ef24eeac993b4da172a5a8f0.exe schtasks.exe PID 836 wrote to memory of 1308 836 ace96cf7ef24eeac993b4da172a5a8f0.exe schtasks.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 836 wrote to memory of 1972 836 ace96cf7ef24eeac993b4da172a5a8f0.exe RegSvcs.exe PID 1972 wrote to memory of 752 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 752 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 752 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 752 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 1344 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 1344 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 1344 1972 RegSvcs.exe schtasks.exe PID 1972 wrote to memory of 1344 1972 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ace96cf7ef24eeac993b4da172a5a8f0.exe"C:\Users\Admin\AppData\Local\Temp\ace96cf7ef24eeac993b4da172a5a8f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWoGxZG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9BE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBDA4.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC2F2.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBDA4.tmpMD5
40b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpC2F2.tmpMD5
c4aecdef99eba873119e79616df3f4b0
SHA1b1b3af52655fb633eed909dfed05b64fbbfac37c
SHA25624fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b
SHA512e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4
-
memory/752-67-0x0000000000000000-mapping.dmp
-
memory/836-55-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/836-57-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/836-56-0x0000000000AC1000-0x0000000000AC2000-memory.dmpFilesize
4KB
-
memory/836-54-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1308-58-0x0000000000000000-mapping.dmp
-
memory/1344-69-0x0000000000000000-mapping.dmp
-
memory/1972-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-64-0x000000000041E792-mapping.dmp
-
memory/1972-66-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1972-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-71-0x0000000000171000-0x0000000000172000-memory.dmpFilesize
4KB
-
memory/1972-72-0x0000000000176000-0x0000000000187000-memory.dmpFilesize
68KB