Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
PostNL klant verzendinformatie document doc.exe
Resource
win7-20220414-en
General
-
Target
PostNL klant verzendinformatie document doc.exe
-
Size
500KB
-
MD5
96197942f6e4fb122810a1188781d9a1
-
SHA1
a19f727211c5120a482af60dfca7042f181f5e3a
-
SHA256
04d57be00e1edddcfd5cd6088b4eec44591c6f0a5f9e6a13b9f90e66a24ccc25
-
SHA512
4c4ab690187abfa8b68641dbe02038d91ec56a9898a69a65709cea7d86cc984df9ef1f7d6658d7f3b0fecd3931bccdf14d828ee09b50b54cb32105a32009f45d
Malware Config
Extracted
nanocore
1.2.2.0
postnl.duckdns.org:1969
127.0.0.1:1969
03803fb4-9846-4772-b30e-fac43bb55ddb
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-27T07:08:14.039616336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
1969
-
default_group
POSTNL
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
03803fb4-9846-4772-b30e-fac43bb55ddb
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
postnl.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PostNL klant verzendinformatie document doc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PostNL klant verzendinformatie document doc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PostNL klant verzendinformatie document doc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PostNL klant verzendinformatie document doc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation PostNL klant verzendinformatie document doc.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PostNL klant verzendinformatie document doc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PostNL klant verzendinformatie document doc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 PostNL klant verzendinformatie document doc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PostNL klant verzendinformatie document doc.exedescription pid process target process PID 4516 set thread context of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PostNL klant verzendinformatie document doc.exeMSBuild.exepid process 4516 PostNL klant verzendinformatie document doc.exe 4876 MSBuild.exe 4876 MSBuild.exe 4876 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 4876 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PostNL klant verzendinformatie document doc.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 4516 PostNL klant verzendinformatie document doc.exe Token: SeDebugPrivilege 4876 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PostNL klant verzendinformatie document doc.exedescription pid process target process PID 4516 wrote to memory of 4820 4516 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 4516 wrote to memory of 4820 4516 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 4516 wrote to memory of 4820 4516 PostNL klant verzendinformatie document doc.exe schtasks.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe PID 4516 wrote to memory of 4876 4516 PostNL klant verzendinformatie document doc.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PostNL klant verzendinformatie document doc.exe"C:\Users\Admin\AppData\Local\Temp\PostNL klant verzendinformatie document doc.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlNpaFxnRflL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D86.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1D86.tmpFilesize
1KB
MD552c840affa6ba86bfe06f76fb607e4ae
SHA11d4d6ff1069c6fa366c72dd89bae24adbbefd885
SHA256e0ef51b5774116c6d06761cb71c093e151af513b20168502fff77f64a76c1945
SHA512be75e8bcd88f8d5f9d6b8ca6af2d2b5ae9a5c6dfec53c0d0f08dcf16f564dfb5b0b4698ba6de8905f568533efd58469652ce259d9c3837c0f9443ded6cc7ada5
-
memory/4516-130-0x0000000074F30000-0x00000000754E1000-memory.dmpFilesize
5.7MB
-
memory/4820-131-0x0000000000000000-mapping.dmp
-
memory/4876-133-0x0000000000000000-mapping.dmp
-
memory/4876-134-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4876-135-0x0000000074F30000-0x00000000754E1000-memory.dmpFilesize
5.7MB