Analysis
-
max time kernel
121s -
max time network
167s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 09:53
Static task
static1
Behavioral task
behavioral1
Sample
Scan_doc81910292021/doblMnP7hpCPcLO.exe
Resource
win7-en-20210920
General
-
Target
Scan_doc81910292021/doblMnP7hpCPcLO.exe
-
Size
420KB
-
MD5
4cad4eb9554abd6d6ea7aec20369fe69
-
SHA1
8d6e536c1661f8423d775f17838e7d489c7935e5
-
SHA256
5bfb1cac480cef041cf243ab99c7b4498ca7a802c6614a0744b06146dd531cf0
-
SHA512
de5d1942f30f890e770886f64c217571482f31be1808bf7b40f52b81ce2d593b9b85387fa301cdf82207abd78335fa1b2f4c2ff24b4b1616b3ae9b2eebe278fb
Malware Config
Extracted
nanocore
1.2.2.0
bustabantu1996.ddns.net:5454
bustabantu1996.duckdns.org:5454
628c9aea-d11c-40ee-81f0-a6cf62e674a4
-
activate_away_mode
true
-
backup_connection_host
bustabantu1996.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-10T05:16:22.140814636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5454
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
628c9aea-d11c-40ee-81f0-a6cf62e674a4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bustabantu1996.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
doblMnP7hpCPcLO.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" doblMnP7hpCPcLO.exe -
Processes:
doblMnP7hpCPcLO.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA doblMnP7hpCPcLO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
doblMnP7hpCPcLO.exedescription pid process target process PID 1792 set thread context of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe -
Drops file in Program Files directory 2 IoCs
Processes:
doblMnP7hpCPcLO.exedescription ioc process File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe doblMnP7hpCPcLO.exe File created C:\Program Files (x86)\UDP Subsystem\udpss.exe doblMnP7hpCPcLO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
doblMnP7hpCPcLO.exedoblMnP7hpCPcLO.exepowershell.exepid process 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 1792 doblMnP7hpCPcLO.exe 544 doblMnP7hpCPcLO.exe 544 doblMnP7hpCPcLO.exe 1356 powershell.exe 544 doblMnP7hpCPcLO.exe 544 doblMnP7hpCPcLO.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
doblMnP7hpCPcLO.exepid process 544 doblMnP7hpCPcLO.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
doblMnP7hpCPcLO.exedoblMnP7hpCPcLO.exepowershell.exedescription pid process Token: SeDebugPrivilege 1792 doblMnP7hpCPcLO.exe Token: SeDebugPrivilege 544 doblMnP7hpCPcLO.exe Token: SeDebugPrivilege 1356 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
doblMnP7hpCPcLO.exedescription pid process target process PID 1792 wrote to memory of 1356 1792 doblMnP7hpCPcLO.exe powershell.exe PID 1792 wrote to memory of 1356 1792 doblMnP7hpCPcLO.exe powershell.exe PID 1792 wrote to memory of 1356 1792 doblMnP7hpCPcLO.exe powershell.exe PID 1792 wrote to memory of 1356 1792 doblMnP7hpCPcLO.exe powershell.exe PID 1792 wrote to memory of 1128 1792 doblMnP7hpCPcLO.exe schtasks.exe PID 1792 wrote to memory of 1128 1792 doblMnP7hpCPcLO.exe schtasks.exe PID 1792 wrote to memory of 1128 1792 doblMnP7hpCPcLO.exe schtasks.exe PID 1792 wrote to memory of 1128 1792 doblMnP7hpCPcLO.exe schtasks.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 1792 wrote to memory of 544 1792 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KJTyqZxfdl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2ECE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-72-0x00000000003E0000-0x00000000003F9000-memory.dmpFilesize
100KB
-
memory/544-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/544-88-0x0000000000B80000-0x0000000000B8F000-memory.dmpFilesize
60KB
-
memory/544-87-0x00000000009B0000-0x00000000009D9000-memory.dmpFilesize
164KB
-
memory/544-86-0x0000000000950000-0x000000000095A000-memory.dmpFilesize
40KB
-
memory/544-85-0x0000000000940000-0x000000000094F000-memory.dmpFilesize
60KB
-
memory/544-84-0x0000000000930000-0x0000000000939000-memory.dmpFilesize
36KB
-
memory/544-73-0x00000000003D0000-0x00000000003D3000-memory.dmpFilesize
12KB
-
memory/544-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/544-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/544-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/544-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/544-67-0x000000000041E792-mapping.dmp
-
memory/544-83-0x0000000000920000-0x000000000092D000-memory.dmpFilesize
52KB
-
memory/544-70-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/544-71-0x00000000003C0000-0x00000000003C5000-memory.dmpFilesize
20KB
-
memory/544-82-0x0000000000910000-0x0000000000917000-memory.dmpFilesize
28KB
-
memory/544-81-0x0000000000900000-0x0000000000906000-memory.dmpFilesize
24KB
-
memory/544-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/544-80-0x00000000008B0000-0x00000000008BC000-memory.dmpFilesize
48KB
-
memory/544-79-0x0000000000890000-0x0000000000896000-memory.dmpFilesize
24KB
-
memory/544-77-0x0000000000750000-0x000000000075D000-memory.dmpFilesize
52KB
-
memory/544-78-0x0000000000760000-0x0000000000775000-memory.dmpFilesize
84KB
-
memory/1128-61-0x0000000000000000-mapping.dmp
-
memory/1356-76-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB
-
memory/1356-75-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB
-
memory/1356-74-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB
-
memory/1356-60-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/1356-59-0x0000000000000000-mapping.dmp
-
memory/1792-56-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/1792-58-0x00000000059C0000-0x0000000005A14000-memory.dmpFilesize
336KB
-
memory/1792-54-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/1792-57-0x0000000000680000-0x0000000000686000-memory.dmpFilesize
24KB