Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:50
Static task
static1
Behavioral task
behavioral1
Sample
STMPO3683HK.exe
Resource
win7-20220414-en
General
-
Target
STMPO3683HK.exe
-
Size
715KB
-
MD5
76a8f2eb76dce33384b6eae299b861cd
-
SHA1
c9028f427d3bfd2efe4b08989ea73be739a6d290
-
SHA256
9eb1cd61e77d7133bd5252c9c7574d4171ba60c856dbedd15754c5b0e3c827b4
-
SHA512
d4bc7ebfe33ac92f003d5800ff9a391e0af2973dff565c1f0806ac6ed37c8b6c138b1294e079909dbfd5294d61099ade4749a7774fe246747a174f4bf300e1b1
Malware Config
Extracted
nanocore
1.2.2.0
darlingtondc.hopto.org:1905
185.165.153.17:1905
9ca847a1-73ff-4b6f-bbac-e86d31071270
-
activate_away_mode
true
-
backup_connection_host
185.165.153.17
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-19T00:49:06.806996136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1905
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9ca847a1-73ff-4b6f-bbac-e86d31071270
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
darlingtondc.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
STMPO3683HK.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA STMPO3683HK.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
STMPO3683HK.exedescription pid process target process PID 1648 set thread context of 884 1648 STMPO3683HK.exe STMPO3683HK.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
STMPO3683HK.exeSTMPO3683HK.exeSTMPO3683HK.exepid process 1648 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 884 STMPO3683HK.exe 884 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe 1420 STMPO3683HK.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
STMPO3683HK.exepid process 884 STMPO3683HK.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
STMPO3683HK.exepid process 1648 STMPO3683HK.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
STMPO3683HK.exedescription pid process Token: SeDebugPrivilege 884 STMPO3683HK.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
STMPO3683HK.exedescription pid process target process PID 1648 wrote to memory of 884 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 884 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 884 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 884 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 1420 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 1420 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 1420 1648 STMPO3683HK.exe STMPO3683HK.exe PID 1648 wrote to memory of 1420 1648 STMPO3683HK.exe STMPO3683HK.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:884 -
C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe" 2 884 70771722⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-55-0x000000000047D4B0-mapping.dmp
-
memory/884-59-0x00000000003B0000-0x00000000003E8000-memory.dmpFilesize
224KB
-
memory/884-57-0x00000000003B0000-0x00000000003E8000-memory.dmpFilesize
224KB
-
memory/884-63-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1420-56-0x0000000000000000-mapping.dmp
-
memory/1420-62-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1648-54-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/1648-58-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB