Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:20
Static task
static1
Behavioral task
behavioral1
Sample
wUoEZ2u21HcHZUB.exe
Resource
win7-20220414-en
General
-
Target
wUoEZ2u21HcHZUB.exe
-
Size
484KB
-
MD5
71e87ef429cefb50f6ad35e4465cceda
-
SHA1
a449a96ae8446f744370a69696af721e9c1bde93
-
SHA256
d5c4abd1ed6e2d15109e2d13d41ff52e2c0ac5203a6e373d2971bff5a75560d7
-
SHA512
15456b249fc1e036281ebe789bd3db9f88298c2395a0eb60bdaade9256b0da642cc45ee7e5f1808f2ebe3b06b7193b87a47cced14dcaf5115927d1237e99549b
Malware Config
Extracted
nanocore
1.2.2.0
hampowell.ddns.net:1777
f7b79aee-15d1-4aa4-b07b-a5ba4d826dd4
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-06-05T17:31:14.638779736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1777
-
default_group
Dera
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f7b79aee-15d1-4aa4-b07b-a5ba4d826dd4
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
hampowell.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wUoEZ2u21HcHZUB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation wUoEZ2u21HcHZUB.exe -
Processes:
wUoEZ2u21HcHZUB.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wUoEZ2u21HcHZUB.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wUoEZ2u21HcHZUB.exedescription pid process target process PID 2340 set thread context of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1988 schtasks.exe 4820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
wUoEZ2u21HcHZUB.exewUoEZ2u21HcHZUB.exepid process 2340 wUoEZ2u21HcHZUB.exe 2340 wUoEZ2u21HcHZUB.exe 2340 wUoEZ2u21HcHZUB.exe 2340 wUoEZ2u21HcHZUB.exe 2352 wUoEZ2u21HcHZUB.exe 2352 wUoEZ2u21HcHZUB.exe 2352 wUoEZ2u21HcHZUB.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wUoEZ2u21HcHZUB.exepid process 2352 wUoEZ2u21HcHZUB.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wUoEZ2u21HcHZUB.exewUoEZ2u21HcHZUB.exedescription pid process Token: SeDebugPrivilege 2340 wUoEZ2u21HcHZUB.exe Token: SeDebugPrivilege 2352 wUoEZ2u21HcHZUB.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
wUoEZ2u21HcHZUB.exewUoEZ2u21HcHZUB.exedescription pid process target process PID 2340 wrote to memory of 1988 2340 wUoEZ2u21HcHZUB.exe schtasks.exe PID 2340 wrote to memory of 1988 2340 wUoEZ2u21HcHZUB.exe schtasks.exe PID 2340 wrote to memory of 1988 2340 wUoEZ2u21HcHZUB.exe schtasks.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2340 wrote to memory of 2352 2340 wUoEZ2u21HcHZUB.exe wUoEZ2u21HcHZUB.exe PID 2352 wrote to memory of 4820 2352 wUoEZ2u21HcHZUB.exe schtasks.exe PID 2352 wrote to memory of 4820 2352 wUoEZ2u21HcHZUB.exe schtasks.exe PID 2352 wrote to memory of 4820 2352 wUoEZ2u21HcHZUB.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yLdJXePhps" /XML "C:\Users\Admin\AppData\Local\Temp\tmp27EB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\wUoEZ2u21HcHZUB.exe"{path}"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2E05.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wUoEZ2u21HcHZUB.exe.logFilesize
507B
MD576ffb2f33cb32ade8fc862a67599e9d8
SHA1920cc4ab75b36d2f9f6e979b74db568973c49130
SHA256f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
SHA512f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
-
C:\Users\Admin\AppData\Local\Temp\tmp27EB.tmpFilesize
1KB
MD56fa8f28de99357976a6b5cc895b4f6e6
SHA188fdd1a22630de78a99910f04bfee95eb5f3cc1b
SHA2566274db712671cc2b57e1a189bc90ae8225e9625b05fd7fa327d861bb7072ed4d
SHA51299a28bc07cf3baf12b45c0cbfcc8812937dbf7fcd50c57a35826c478bd2a5a27fe5815036b0350ea771ebe67ee8a8696791e81457f5c85e5aebfd08b0a7622e4
-
C:\Users\Admin\AppData\Local\Temp\tmp2E05.tmpFilesize
1KB
MD5ef6394c37d06d4b83af0cdfd217d02e1
SHA1b00372ce8cb4f54a14d6cdb2a754ea040e4b6224
SHA256f53208e4849caa24448d453eb38e796cfb906af8cc9a64fb834a3fa3d0268a68
SHA5122ae58684685b7d3381afee98ae0843960ac010163a0312b8daad03a76754b4d3702903bcfc0c7f3be53ed4426b5a2572fae9c55d78d82c62fd81155e547cb683
-
memory/1988-134-0x0000000000000000-mapping.dmp
-
memory/2340-130-0x0000000000B80000-0x0000000000C00000-memory.dmpFilesize
512KB
-
memory/2340-131-0x0000000005B10000-0x00000000060B4000-memory.dmpFilesize
5.6MB
-
memory/2340-132-0x0000000005600000-0x0000000005692000-memory.dmpFilesize
584KB
-
memory/2340-133-0x0000000006440000-0x00000000064DC000-memory.dmpFilesize
624KB
-
memory/2352-136-0x0000000000000000-mapping.dmp
-
memory/2352-137-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2352-139-0x00000000051C0000-0x00000000051CA000-memory.dmpFilesize
40KB
-
memory/4820-140-0x0000000000000000-mapping.dmp