Analysis
-
max time kernel
202s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - sample & specification_#R2100131410.exe
Resource
win7-20220414-en
General
-
Target
RFQ - sample & specification_#R2100131410.exe
-
Size
510KB
-
MD5
ad0044dc21c79a4ff11f069ddc41dce7
-
SHA1
c09ddf327210cfcdd1a3d5d39fd36dfdf79d9b56
-
SHA256
80f6bea4ffb5f80f64b9b23b96e6ba3e3d7d5eaf1bc8bf3ea1966a6d4469c648
-
SHA512
cc94a200fba1c8aa36cff686e40138e7753fe1b9331f0085362e48a93bb807fccc1d00fe3ab7a3143abafa8b53d8645f903d2baa8da9a2c6992b09f47c41018c
Malware Config
Extracted
nanocore
1.2.2.0
billion1920.duckdns.org:56372
91.192.100.25:56372
aa99d9f5-5722-4e07-9fc2-f779c77bfa3a
-
activate_away_mode
true
-
backup_connection_host
91.192.100.25
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-08T16:56:13.298869536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
56372
-
default_group
7/27 1billion
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
aa99d9f5-5722-4e07-9fc2-f779c77bfa3a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
billion1920.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RFQ - sample & specification_#R2100131410.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation RFQ - sample & specification_#R2100131410.exe -
Processes:
RFQ - sample & specification_#R2100131410.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RFQ - sample & specification_#R2100131410.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exedescription pid process target process PID 4596 set thread context of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exeRFQ - sample & specification_#R2100131410.exepid process 4596 RFQ - sample & specification_#R2100131410.exe 4596 RFQ - sample & specification_#R2100131410.exe 4596 RFQ - sample & specification_#R2100131410.exe 4596 RFQ - sample & specification_#R2100131410.exe 4596 RFQ - sample & specification_#R2100131410.exe 4596 RFQ - sample & specification_#R2100131410.exe 1536 RFQ - sample & specification_#R2100131410.exe 1536 RFQ - sample & specification_#R2100131410.exe 1536 RFQ - sample & specification_#R2100131410.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exepid process 1536 RFQ - sample & specification_#R2100131410.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exeRFQ - sample & specification_#R2100131410.exedescription pid process Token: SeDebugPrivilege 4596 RFQ - sample & specification_#R2100131410.exe Token: SeDebugPrivilege 1536 RFQ - sample & specification_#R2100131410.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
RFQ - sample & specification_#R2100131410.exedescription pid process target process PID 4596 wrote to memory of 1420 4596 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 4596 wrote to memory of 1420 4596 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 4596 wrote to memory of 1420 4596 RFQ - sample & specification_#R2100131410.exe schtasks.exe PID 4596 wrote to memory of 2792 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 2792 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 2792 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe PID 4596 wrote to memory of 1536 4596 RFQ - sample & specification_#R2100131410.exe RFQ - sample & specification_#R2100131410.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4793.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ - sample & specification_#R2100131410.exe"{path}"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RFQ - sample & specification_#R2100131410.exe.logFilesize
496B
MD5cb76b18ebed3a9f05a14aed43d35fba6
SHA1836a4b4e351846fca08b84149cb734cb59b8c0d6
SHA2568d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349
SHA5127631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c
-
C:\Users\Admin\AppData\Local\Temp\tmp4793.tmpFilesize
1KB
MD5072541fbcc0f05e7e00afb8876087822
SHA10a1a6ad25a4a546520fe21bed23b4dd56f5ea7f5
SHA2568a98b2e2084e096028123a79228bc1b11f12179aecfbe53759b3e0805f973116
SHA51207074f512ee920a787af3d49d982795121051cc5cd1ce01d115aab63cd800fd58f2f57e73dafb96151e57ada9d2e407e370abc9c56d8ab604d118dad93c1412d
-
memory/1420-131-0x0000000000000000-mapping.dmp
-
memory/1536-134-0x0000000000000000-mapping.dmp
-
memory/1536-135-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1536-137-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/2792-133-0x0000000000000000-mapping.dmp
-
memory/4596-130-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB