Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 09:53
Static task
static1
Behavioral task
behavioral1
Sample
Scan_doc81910292021/doblMnP7hpCPcLO.exe
Resource
win7-en-20210920
General
-
Target
Scan_doc81910292021/doblMnP7hpCPcLO.exe
-
Size
420KB
-
MD5
4cad4eb9554abd6d6ea7aec20369fe69
-
SHA1
8d6e536c1661f8423d775f17838e7d489c7935e5
-
SHA256
5bfb1cac480cef041cf243ab99c7b4498ca7a802c6614a0744b06146dd531cf0
-
SHA512
de5d1942f30f890e770886f64c217571482f31be1808bf7b40f52b81ce2d593b9b85387fa301cdf82207abd78335fa1b2f4c2ff24b4b1616b3ae9b2eebe278fb
Malware Config
Extracted
nanocore
1.2.2.0
bustabantu1996.ddns.net:5454
bustabantu1996.duckdns.org:5454
628c9aea-d11c-40ee-81f0-a6cf62e674a4
-
activate_away_mode
true
-
backup_connection_host
bustabantu1996.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-10T05:16:22.140814636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5454
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
628c9aea-d11c-40ee-81f0-a6cf62e674a4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bustabantu1996.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
doblMnP7hpCPcLO.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" doblMnP7hpCPcLO.exe -
Processes:
doblMnP7hpCPcLO.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA doblMnP7hpCPcLO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
doblMnP7hpCPcLO.exedescription pid process target process PID 744 set thread context of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe -
Drops file in Program Files directory 2 IoCs
Processes:
doblMnP7hpCPcLO.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe doblMnP7hpCPcLO.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe doblMnP7hpCPcLO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
doblMnP7hpCPcLO.exepowershell.exedoblMnP7hpCPcLO.exepid process 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 744 doblMnP7hpCPcLO.exe 4052 powershell.exe 4052 powershell.exe 592 doblMnP7hpCPcLO.exe 592 doblMnP7hpCPcLO.exe 592 doblMnP7hpCPcLO.exe 4052 powershell.exe 592 doblMnP7hpCPcLO.exe 592 doblMnP7hpCPcLO.exe 592 doblMnP7hpCPcLO.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
doblMnP7hpCPcLO.exepid process 592 doblMnP7hpCPcLO.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
doblMnP7hpCPcLO.exepowershell.exedoblMnP7hpCPcLO.exedescription pid process Token: SeDebugPrivilege 744 doblMnP7hpCPcLO.exe Token: SeDebugPrivilege 4052 powershell.exe Token: SeDebugPrivilege 592 doblMnP7hpCPcLO.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
doblMnP7hpCPcLO.exedescription pid process target process PID 744 wrote to memory of 4052 744 doblMnP7hpCPcLO.exe powershell.exe PID 744 wrote to memory of 4052 744 doblMnP7hpCPcLO.exe powershell.exe PID 744 wrote to memory of 4052 744 doblMnP7hpCPcLO.exe powershell.exe PID 744 wrote to memory of 512 744 doblMnP7hpCPcLO.exe schtasks.exe PID 744 wrote to memory of 512 744 doblMnP7hpCPcLO.exe schtasks.exe PID 744 wrote to memory of 512 744 doblMnP7hpCPcLO.exe schtasks.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe PID 744 wrote to memory of 592 744 doblMnP7hpCPcLO.exe doblMnP7hpCPcLO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KJTyqZxfdl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA10E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"C:\Users\Admin\AppData\Local\Temp\Scan_doc81910292021\doblMnP7hpCPcLO.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/512-126-0x0000000000000000-mapping.dmp
-
memory/592-148-0x0000000005370000-0x000000000586E000-memory.dmpFilesize
5.0MB
-
memory/592-129-0x000000000041E792-mapping.dmp
-
memory/592-142-0x0000000005840000-0x0000000005845000-memory.dmpFilesize
20KB
-
memory/592-128-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/592-143-0x0000000005850000-0x0000000005869000-memory.dmpFilesize
100KB
-
memory/592-144-0x0000000006170000-0x0000000006173000-memory.dmpFilesize
12KB
-
memory/744-119-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/744-123-0x0000000006DB0000-0x0000000006E04000-memory.dmpFilesize
336KB
-
memory/744-122-0x00000000087F0000-0x00000000087F1000-memory.dmpFilesize
4KB
-
memory/744-121-0x00000000086E0000-0x00000000086E6000-memory.dmpFilesize
24KB
-
memory/744-120-0x00000000050C0000-0x00000000055BE000-memory.dmpFilesize
5.0MB
-
memory/744-115-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/744-118-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/744-117-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/4052-139-0x00000000080E0000-0x00000000080E1000-memory.dmpFilesize
4KB
-
memory/4052-124-0x0000000000000000-mapping.dmp
-
memory/4052-138-0x0000000007890000-0x0000000007891000-memory.dmpFilesize
4KB
-
memory/4052-131-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/4052-141-0x0000000008330000-0x0000000008331000-memory.dmpFilesize
4KB
-
memory/4052-130-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/4052-127-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/4052-125-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/4052-145-0x0000000008210000-0x0000000008211000-memory.dmpFilesize
4KB
-
memory/4052-146-0x0000000007370000-0x0000000007371000-memory.dmpFilesize
4KB
-
memory/4052-147-0x0000000007372000-0x0000000007373000-memory.dmpFilesize
4KB
-
memory/4052-137-0x00000000077F0000-0x00000000077F1000-memory.dmpFilesize
4KB
-
memory/4052-149-0x00000000086F0000-0x00000000086F1000-memory.dmpFilesize
4KB
-
memory/4052-150-0x0000000008A30000-0x0000000008A31000-memory.dmpFilesize
4KB
-
memory/4052-151-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/4052-158-0x000000007F130000-0x000000007F131000-memory.dmpFilesize
4KB
-
memory/4052-159-0x0000000009970000-0x00000000099A3000-memory.dmpFilesize
204KB
-
memory/4052-166-0x0000000009930000-0x0000000009931000-memory.dmpFilesize
4KB
-
memory/4052-171-0x0000000009AA0000-0x0000000009AA1000-memory.dmpFilesize
4KB
-
memory/4052-172-0x0000000009CC0000-0x0000000009CC1000-memory.dmpFilesize
4KB
-
memory/4052-241-0x0000000007373000-0x0000000007374000-memory.dmpFilesize
4KB