Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 12:42
Static task
static1
Behavioral task
behavioral1
Sample
11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe
Resource
win10v2004-20220414-en
General
-
Target
11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe
-
Size
708KB
-
MD5
848a0266b194123408dd4429ef761db0
-
SHA1
95348194c757655c1d7832db285de8d3d3baf8f5
-
SHA256
11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec
-
SHA512
49240e1684c2bf7eaf5e869b95cf878693811148b37aa73db6cfcfb46331dc3c2bccc5455f99d180964202571f6e31a918ffc17e6458aede1db2c04607249440
Malware Config
Extracted
nanocore
1.2.2.0
farah99.zapto.org:19720
6d50c134-6325-499c-b5ec-dbc7a37a8117
-
activate_away_mode
true
-
backup_connection_host
farah99.zapto.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-08-20T23:36:09.518759436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
19720
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6d50c134-6325-499c-b5ec-dbc7a37a8117
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
farah99.zapto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Monitor = "C:\\Program Files (x86)\\WPA Monitor\\wpamon.exe" 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1836 set thread context of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WPA Monitor\wpamon.exe 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe File opened for modification C:\Program Files (x86)\WPA Monitor\wpamon.exe 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 2212 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 2212 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 2212 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2212 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe Token: SeDebugPrivilege 2212 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1836 wrote to memory of 4600 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 81 PID 1836 wrote to memory of 4600 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 81 PID 1836 wrote to memory of 4600 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 81 PID 1836 wrote to memory of 1116 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 83 PID 1836 wrote to memory of 1116 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 83 PID 1836 wrote to memory of 1116 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 83 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84 PID 1836 wrote to memory of 2212 1836 11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe"C:\Users\Admin\AppData\Local\Temp\11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XGcETK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA98.tmp"2⤵
- Creates scheduled task(s)
PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe"{path}"2⤵PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\11e036c1794cd85102d2db5dc7cd5e1440d266ccd6f09fb541661c63ddbebeec.exe.log
Filesize1KB
MD5531595e2b5f12461e210c410faf46d37
SHA14c163e51d2a43c5514f4064dd3bc9e9470ed752c
SHA25640b7c802bfe6623c91a471cb1525738c9bc6e38125d3ea4c73b26f468ca83b51
SHA512ac815c417c53b6a04415f022655ee4fe014f9f80c540b0b595e3dfc4e744458c2eaee5d535a14bc488a27afb5b53e5289eca23434fd1ba10ae231ae6678d1e6b
-
Filesize
1KB
MD52aaad82e0cfd3b29beaff08b0931ac0f
SHA11f610cddbcf509397aeb9c22c2ea9ff81cd30650
SHA256715315047bb1765ed352649b1743893029459bc9f07d10086ad790033afc196e
SHA512a332e48f594c3ca9cf08bdf11a2698f62e82d63a155da39125f3005d955630b81f5ab5996a312ea253a656351f07d19d3b70a241cec74960110b7501dccc465c