Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:40
Static task
static1
Behavioral task
behavioral1
Sample
BLOCKCHAIN PROFITS.exe
Resource
win7-20220414-en
General
-
Target
BLOCKCHAIN PROFITS.exe
-
Size
689KB
-
MD5
c08eb12ecaa916adf619ee43f51eafdb
-
SHA1
4c2ee4f8d5ef47bb596798b05759b0657dd52fdf
-
SHA256
e120ac129520252fca7d20dc99cddc1380aab646c8330a002a52e81b0d0f29fe
-
SHA512
69d06d4aa1901ddc7074fc685af1230ef37240e92a8abbe66b20707175368202e93c395fa6a687886579715dd6a5598dea257d7fd0c2efbec8aab8ef8a6f994b
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.204:1604
ec39f208-74bc-4969-8711-c556f5a23d7b
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-23T20:00:04.539862636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1604
-
default_group
Ali
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ec39f208-74bc-4969-8711-c556f5a23d7b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.204
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BLOCKCHAIN PROFITS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation BLOCKCHAIN PROFITS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Monitor = "C:\\Program Files (x86)\\WPA Monitor\\wpamon.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BLOCKCHAIN PROFITS.exedescription pid process target process PID 4588 set thread context of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\WPA Monitor\wpamon.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\WPA Monitor\wpamon.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2168 schtasks.exe 1548 schtasks.exe 2580 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BLOCKCHAIN PROFITS.exeRegSvcs.exepid process 4588 BLOCKCHAIN PROFITS.exe 4896 RegSvcs.exe 4896 RegSvcs.exe 4896 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4896 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BLOCKCHAIN PROFITS.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4588 BLOCKCHAIN PROFITS.exe Token: SeDebugPrivilege 4896 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
BLOCKCHAIN PROFITS.exeRegSvcs.exedescription pid process target process PID 4588 wrote to memory of 2168 4588 BLOCKCHAIN PROFITS.exe schtasks.exe PID 4588 wrote to memory of 2168 4588 BLOCKCHAIN PROFITS.exe schtasks.exe PID 4588 wrote to memory of 2168 4588 BLOCKCHAIN PROFITS.exe schtasks.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4588 wrote to memory of 4896 4588 BLOCKCHAIN PROFITS.exe RegSvcs.exe PID 4896 wrote to memory of 1548 4896 RegSvcs.exe schtasks.exe PID 4896 wrote to memory of 1548 4896 RegSvcs.exe schtasks.exe PID 4896 wrote to memory of 1548 4896 RegSvcs.exe schtasks.exe PID 4896 wrote to memory of 2580 4896 RegSvcs.exe schtasks.exe PID 4896 wrote to memory of 2580 4896 RegSvcs.exe schtasks.exe PID 4896 wrote to memory of 2580 4896 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLOCKCHAIN PROFITS.exe"C:\Users\Admin\AppData\Local\Temp\BLOCKCHAIN PROFITS.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WziNzEiTbSi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B20.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3FD3.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4060.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3B20.tmpFilesize
1KB
MD5fcfba283de331f3d0ddda2d7dae16091
SHA1b2d81b3ea03d51aba6bc53e3e7900481d01d77f7
SHA256f2bba526a9b9bcef1520f38e242898ea2dbcd6e0229a2aa237c8b55b9c37d2c8
SHA512354dcec896a0934aec18e3be9da793fb6cba47a52bae10ee3bb9a66b802a88dade27cfb415083ac2caefb3385a4aee8581d5cf20ad57ea2853c3b47e5f2fcbba
-
C:\Users\Admin\AppData\Local\Temp\tmp3FD3.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp4060.tmpFilesize
1KB
MD5a246b3561d823177f3586e629f144233
SHA10f05d12e55a1d2e5e6a4f307c193882fba093315
SHA2566abae7707b06e52b58f537b335e367cc54b093e899d78f16e94ceaf7ceafca52
SHA5124246aa9a96331e2c7e36b37fa778e31ecae055c77164e0dc673aa50cdec368f08d356ab06ef1a4540816c474828048ab1bebed7e211a4eb929f2918e1fac9c6d
-
memory/1548-135-0x0000000000000000-mapping.dmp
-
memory/2168-131-0x0000000000000000-mapping.dmp
-
memory/2580-137-0x0000000000000000-mapping.dmp
-
memory/4588-130-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB
-
memory/4896-133-0x0000000000000000-mapping.dmp
-
memory/4896-134-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4896-139-0x00000000750F0000-0x00000000756A1000-memory.dmpFilesize
5.7MB