Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
PostNL klant verzendinformatie document doc.exe
Resource
win7-20220414-en
General
-
Target
PostNL klant verzendinformatie document doc.exe
-
Size
500KB
-
MD5
96197942f6e4fb122810a1188781d9a1
-
SHA1
a19f727211c5120a482af60dfca7042f181f5e3a
-
SHA256
04d57be00e1edddcfd5cd6088b4eec44591c6f0a5f9e6a13b9f90e66a24ccc25
-
SHA512
4c4ab690187abfa8b68641dbe02038d91ec56a9898a69a65709cea7d86cc984df9ef1f7d6658d7f3b0fecd3931bccdf14d828ee09b50b54cb32105a32009f45d
Malware Config
Extracted
nanocore
1.2.2.0
postnl.duckdns.org:1969
127.0.0.1:1969
03803fb4-9846-4772-b30e-fac43bb55ddb
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-27T07:08:14.039616336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
1969
-
default_group
POSTNL
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
03803fb4-9846-4772-b30e-fac43bb55ddb
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
postnl.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PostNL klant verzendinformatie document doc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PostNL klant verzendinformatie document doc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PostNL klant verzendinformatie document doc.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PostNL klant verzendinformatie document doc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 PostNL klant verzendinformatie document doc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PostNL klant verzendinformatie document doc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PostNL klant verzendinformatie document doc.exedescription pid process target process PID 240 set thread context of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 1728 MSBuild.exe 1728 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1728 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PostNL klant verzendinformatie document doc.exedescription pid process target process PID 240 wrote to memory of 644 240 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 240 wrote to memory of 644 240 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 240 wrote to memory of 644 240 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 240 wrote to memory of 644 240 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 240 wrote to memory of 1728 240 PostNL klant verzendinformatie document doc.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PostNL klant verzendinformatie document doc.exe"C:\Users\Admin\AppData\Local\Temp\PostNL klant verzendinformatie document doc.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlNpaFxnRflL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB38.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB38.tmpFilesize
1KB
MD56176b060087fb26d98d4a88d57ddb270
SHA10a399963358e3eda3d2488e685951fa9b92d21c0
SHA2567774330a0de8067b7f27c1378042b2907ef59b4ab1b0fb1d968fd7f96010076d
SHA51252fbf26ca5a3e9caf06d9334fad75a5caec72e1164550a2d8714a588b5dd4ef5c16f2d288256a38d9b08febd5c4b759aa3075ce72c1b902f8e6f3ba6eaee466d
-
memory/240-54-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/240-55-0x00000000748C0000-0x0000000074E6B000-memory.dmpFilesize
5.7MB
-
memory/644-56-0x0000000000000000-mapping.dmp
-
memory/1728-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-65-0x000000000041E792-mapping.dmp
-
memory/1728-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1728-71-0x00000000748C0000-0x0000000074E6B000-memory.dmpFilesize
5.7MB
-
memory/1728-72-0x00000000023C6000-0x00000000023D7000-memory.dmpFilesize
68KB