Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:20
Static task
static1
Behavioral task
behavioral1
Sample
wUoEZ2u21HcHZUB.exe
Resource
win7-20220414-en
General
-
Target
wUoEZ2u21HcHZUB.exe
-
Size
484KB
-
MD5
71e87ef429cefb50f6ad35e4465cceda
-
SHA1
a449a96ae8446f744370a69696af721e9c1bde93
-
SHA256
d5c4abd1ed6e2d15109e2d13d41ff52e2c0ac5203a6e373d2971bff5a75560d7
-
SHA512
15456b249fc1e036281ebe789bd3db9f88298c2395a0eb60bdaade9256b0da642cc45ee7e5f1808f2ebe3b06b7193b87a47cced14dcaf5115927d1237e99549b
Malware Config
Extracted
nanocore
1.2.2.0
hampowell.ddns.net:1777
f7b79aee-15d1-4aa4-b07b-a5ba4d826dd4
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-06-05T17:31:14.638779736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1777
-
default_group
Dera
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f7b79aee-15d1-4aa4-b07b-a5ba4d826dd4
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
hampowell.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
wUoEZ2u21HcHZUB.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wUoEZ2u21HcHZUB.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wUoEZ2u21HcHZUB.exedescription pid process target process PID 1744 set thread context of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
wUoEZ2u21HcHZUB.exewUoEZ2u21HcHZUB.exepid process 1744 wUoEZ2u21HcHZUB.exe 1744 wUoEZ2u21HcHZUB.exe 1744 wUoEZ2u21HcHZUB.exe 1744 wUoEZ2u21HcHZUB.exe 1744 wUoEZ2u21HcHZUB.exe 1744 wUoEZ2u21HcHZUB.exe 1744 wUoEZ2u21HcHZUB.exe 1784 wUoEZ2u21HcHZUB.exe 1784 wUoEZ2u21HcHZUB.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wUoEZ2u21HcHZUB.exewUoEZ2u21HcHZUB.exedescription pid process Token: SeDebugPrivilege 1744 wUoEZ2u21HcHZUB.exe Token: SeDebugPrivilege 1784 wUoEZ2u21HcHZUB.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
wUoEZ2u21HcHZUB.exewUoEZ2u21HcHZUB.exedescription pid process target process PID 1744 wrote to memory of 948 1744 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1744 wrote to memory of 948 1744 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1744 wrote to memory of 948 1744 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1744 wrote to memory of 948 1744 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1744 wrote to memory of 2004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 2004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 2004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 2004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 696 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 696 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 696 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 696 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1424 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1424 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1424 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1424 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1004 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1744 wrote to memory of 1784 1744 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 1784 wrote to memory of 1288 1784 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1784 wrote to memory of 1288 1784 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1784 wrote to memory of 1288 1784 wUoEZ2u21HcHZUB.exe schtasks.exe PID 1784 wrote to memory of 1288 1784 wUoEZ2u21HcHZUB.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yLdJXePhps" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96D4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"{path}"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC66C.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp96D4.tmpFilesize
1KB
MD5d2a3e04c56c597a702cf57475d994d83
SHA110100baffae72f356aa270f20040d41a4f1ab67d
SHA256b9a898392af132ab1c9b90a6e3b0e595bc29a5aa730cf19a24a1edc85e2a408f
SHA5126439196fe689dacf1f47f5407bb19270d5060605ae5b2acef5bfcec14d24f93c1c8b8fb029ddff83152c0fc874d34e337488041b118ec20deee5039918721166
-
C:\Users\Admin\AppData\Local\Temp\tmpC66C.tmpFilesize
1KB
MD5ef6394c37d06d4b83af0cdfd217d02e1
SHA1b00372ce8cb4f54a14d6cdb2a754ea040e4b6224
SHA256f53208e4849caa24448d453eb38e796cfb906af8cc9a64fb834a3fa3d0268a68
SHA5122ae58684685b7d3381afee98ae0843960ac010163a0312b8daad03a76754b4d3702903bcfc0c7f3be53ed4426b5a2572fae9c55d78d82c62fd81155e547cb683
-
memory/948-58-0x0000000000000000-mapping.dmp
-
memory/1288-73-0x0000000000000000-mapping.dmp
-
memory/1744-57-0x0000000003FB0000-0x0000000004006000-memory.dmpFilesize
344KB
-
memory/1744-56-0x0000000004BA0000-0x0000000004C0E000-memory.dmpFilesize
440KB
-
memory/1744-55-0x00000000002B0000-0x00000000002BA000-memory.dmpFilesize
40KB
-
memory/1744-54-0x00000000001C0000-0x0000000000240000-memory.dmpFilesize
512KB
-
memory/1784-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-67-0x000000000041E792-mapping.dmp
-
memory/1784-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-72-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1784-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1784-75-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/1784-76-0x0000000001F40000-0x0000000001F5E000-memory.dmpFilesize
120KB
-
memory/1784-77-0x0000000001EE0000-0x0000000001EEA000-memory.dmpFilesize
40KB