Analysis
-
max time kernel
173s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - sample & specification_#R2100131410.exe
Resource
win7-20220414-en
General
-
Target
RFQ - sample & specification_#R2100131410.exe
-
Size
510KB
-
MD5
ad0044dc21c79a4ff11f069ddc41dce7
-
SHA1
c09ddf327210cfcdd1a3d5d39fd36dfdf79d9b56
-
SHA256
80f6bea4ffb5f80f64b9b23b96e6ba3e3d7d5eaf1bc8bf3ea1966a6d4469c648
-
SHA512
cc94a200fba1c8aa36cff686e40138e7753fe1b9331f0085362e48a93bb807fccc1d00fe3ab7a3143abafa8b53d8645f903d2baa8da9a2c6992b09f47c41018c
Malware Config
Extracted
nanocore
1.2.2.0
billion1920.duckdns.org:56372
91.192.100.25:56372
aa99d9f5-5722-4e07-9fc2-f779c77bfa3a
-
activate_away_mode
true
-
backup_connection_host
91.192.100.25
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-08T16:56:13.298869536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
56372
-
default_group
7/27 1billion
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
aa99d9f5-5722-4e07-9fc2-f779c77bfa3a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
billion1920.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
RFQ - sample & specification_#R2100131410.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RFQ - sample & specification_#R2100131410.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exedescription pid process target process PID 1080 set thread context of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exeRFQ - sample & specification_#R2100131410.exepid process 1080 RFQ - sample & specification_#R2100131410.exe 1080 RFQ - sample & specification_#R2100131410.exe 1080 RFQ - sample & specification_#R2100131410.exe 1080 RFQ - sample & specification_#R2100131410.exe 1080 RFQ - sample & specification_#R2100131410.exe 708 RFQ - sample & specification_#R2100131410.exe 708 RFQ - sample & specification_#R2100131410.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exepid process 708 RFQ - sample & specification_#R2100131410.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exeRFQ - sample & specification_#R2100131410.exedescription pid process Token: SeDebugPrivilege 1080 RFQ - sample & specification_#R2100131410.exe Token: SeDebugPrivilege 708 RFQ - sample & specification_#R2100131410.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exedescription pid process target process PID 1080 wrote to memory of 2024 1080 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 1080 wrote to memory of 2024 1080 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 1080 wrote to memory of 2024 1080 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 1080 wrote to memory of 2024 1080 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 1080 wrote to memory of 2008 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 2008 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 2008 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 2008 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 608 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 608 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 608 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 608 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 1080 wrote to memory of 708 1080 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE12C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"{path}"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE12C.tmpFilesize
1KB
MD5ab15c7fe3dc23f51a8ed4545eb54a9cb
SHA1206a5e711a5b8819deae10c568fa760a23d9308c
SHA2562889f7b15e75b474bfa37c720f216861f138e8e39e1d2f807ce751a21086674b
SHA51229b8f09dfa625fad63d6cae0fd9d9f9ea19a4b5a001138c5afb644c0d37f1cc2e7bf51a4242af433568b22b19613b1570a234474663cc659dd4ad54c7407a114
-
memory/708-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-65-0x000000000041E792-mapping.dmp
-
memory/708-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/708-71-0x0000000074900000-0x0000000074EAB000-memory.dmpFilesize
5.7MB
-
memory/1080-55-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1080-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/2024-56-0x0000000000000000-mapping.dmp