Analysis
-
max time kernel
70s -
max time network
152s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
04-07-2022 01:10
Static task
static1
General
-
Target
1.exe
-
Size
619KB
-
MD5
f335a0ae9553c9acbee866d8990ee9e1
-
SHA1
ce0a21956e2c565e2e332a10f9c2b3346f8cf9b4
-
SHA256
21281c48dd7beeb19d22aef27f4d77f79c550fc32acc69d4c3b91966cc8a048b
-
SHA512
61148e48009d7c3e9d9c3b061008a916020c613b4a6c753140257c5f30f5e5869ab1523818d535d56e5836b3d7f4c52d11970ec0ecb7ca6a67a9adb53ef14a8d
Malware Config
Extracted
nanocore
1.2.2.0
config.linkpc.net:3425
e5ec3588-c148-476e-a8f8-2e9038dcba4d
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2022-04-01T12:01:12.053123736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3425
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
e5ec3588-c148-476e-a8f8-2e9038dcba4d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
config.linkpc.net
-
primary_dns_server
config.linkpc.net
-
request_elevation
true
-
restart_delay
5000
-
run_delay
15
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Processes:
1.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1.exedescription pid process target process PID 920 set thread context of 1760 920 1.exe 1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3008 schtasks.exe 4060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
1.exepowershell.exe1.exepid process 920 1.exe 920 1.exe 920 1.exe 2352 powershell.exe 2352 powershell.exe 2352 powershell.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1.exepid process 1760 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1.exepowershell.exe1.exedescription pid process Token: SeDebugPrivilege 920 1.exe Token: SeDebugPrivilege 2352 powershell.exe Token: SeDebugPrivilege 1760 1.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1.exe1.exedescription pid process target process PID 920 wrote to memory of 2352 920 1.exe powershell.exe PID 920 wrote to memory of 2352 920 1.exe powershell.exe PID 920 wrote to memory of 2352 920 1.exe powershell.exe PID 920 wrote to memory of 3008 920 1.exe schtasks.exe PID 920 wrote to memory of 3008 920 1.exe schtasks.exe PID 920 wrote to memory of 3008 920 1.exe schtasks.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 920 wrote to memory of 1760 920 1.exe 1.exe PID 1760 wrote to memory of 4060 1760 1.exe schtasks.exe PID 1760 wrote to memory of 4060 1760 1.exe schtasks.exe PID 1760 wrote to memory of 4060 1760 1.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jSJiBOvzra.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jSJiBOvzra" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DSL Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7A7F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1.exe.logFilesize
1KB
MD50c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmpFilesize
1KB
MD503925288edfb406376f6cafc96dd292e
SHA181dcce23ba25887a101bbb7060c0fd755803db68
SHA25685f632b9b951f95680b004f5f1a869af3fcbd551ec838080d0c55dadc2537bf2
SHA5128639b44b22e4ca3c605bb7ebb615eb328f96007907ec70e66a793bd91377cb652c0476761f8aa7c58f02fa7efad0e4abf7ac084f3d562704b691f6ad88fb0044
-
C:\Users\Admin\AppData\Local\Temp\tmp7A7F.tmpFilesize
1KB
MD56a8c27f1e1b63d9ff2fa6afcd6492122
SHA104a450f99d1fd53fc321c68cccdd98ba517463f9
SHA25616e9f7f64b56c72c0b7f4c63ecdd38af7ce6f1c4391f222a7770a810264a847f
SHA5120814ca85b9dc07c86bfea1297b7bd0d3145aa5d7230dc7023c2c4fa1f53927f02b5cb417fb5720356eee22d6fc6e908f295b66313dc7f71aaa2548521e78e07d
-
memory/920-170-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-156-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-121-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-122-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-123-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-124-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-125-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-126-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-127-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-128-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-129-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-130-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-131-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-132-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-133-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-134-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-135-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-136-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-137-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-138-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-173-0x0000000004F50000-0x0000000004F5A000-memory.dmpFilesize
40KB
-
memory/920-140-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-141-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-142-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-143-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-144-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-145-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-146-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-147-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-148-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-149-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-150-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-151-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-152-0x0000000000690000-0x0000000000730000-memory.dmpFilesize
640KB
-
memory/920-153-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-154-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-155-0x0000000005640000-0x0000000005B3E000-memory.dmpFilesize
5.0MB
-
memory/920-171-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-157-0x0000000004FE0000-0x0000000005072000-memory.dmpFilesize
584KB
-
memory/920-158-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-159-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-160-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-161-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-162-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-163-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-164-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-165-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-166-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-167-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-168-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-169-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-119-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-172-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-120-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-139-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-174-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-175-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-176-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-177-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-178-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-179-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-180-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-181-0x0000000005310000-0x0000000005326000-memory.dmpFilesize
88KB
-
memory/920-182-0x0000000007510000-0x000000000751A000-memory.dmpFilesize
40KB
-
memory/920-183-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-184-0x0000000007760000-0x00000000077D2000-memory.dmpFilesize
456KB
-
memory/920-185-0x0000000007880000-0x000000000791C000-memory.dmpFilesize
624KB
-
memory/920-186-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-187-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-188-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-189-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/920-243-0x00000000076B0000-0x00000000076EA000-memory.dmpFilesize
232KB
-
memory/920-118-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1760-398-0x00000000067C0000-0x00000000067D4000-memory.dmpFilesize
80KB
-
memory/1760-389-0x0000000006720000-0x000000000673A000-memory.dmpFilesize
104KB
-
memory/1760-404-0x0000000006830000-0x0000000006844000-memory.dmpFilesize
80KB
-
memory/1760-402-0x00000000067F0000-0x000000000681E000-memory.dmpFilesize
184KB
-
memory/1760-400-0x00000000067E0000-0x00000000067EE000-memory.dmpFilesize
56KB
-
memory/1760-308-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1760-397-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/1760-396-0x00000000067A0000-0x00000000067B4000-memory.dmpFilesize
80KB
-
memory/1760-394-0x0000000006780000-0x000000000678C000-memory.dmpFilesize
48KB
-
memory/1760-395-0x0000000006790000-0x000000000679E000-memory.dmpFilesize
56KB
-
memory/1760-390-0x0000000006760000-0x000000000676E000-memory.dmpFilesize
56KB
-
memory/1760-392-0x0000000006770000-0x0000000006782000-memory.dmpFilesize
72KB
-
memory/1760-248-0x000000000041E792-mapping.dmp
-
memory/1760-373-0x0000000004F80000-0x0000000004F8A000-memory.dmpFilesize
40KB
-
memory/1760-375-0x00000000051D0000-0x00000000051EE000-memory.dmpFilesize
120KB
-
memory/1760-376-0x00000000051F0000-0x00000000051FA000-memory.dmpFilesize
40KB
-
memory/1760-387-0x0000000006710000-0x0000000006722000-memory.dmpFilesize
72KB
-
memory/2352-339-0x0000000008000000-0x000000000804B000-memory.dmpFilesize
300KB
-
memory/2352-316-0x0000000007A50000-0x0000000007A72000-memory.dmpFilesize
136KB
-
memory/2352-631-0x0000000009640000-0x0000000009648000-memory.dmpFilesize
32KB
-
memory/2352-196-0x0000000000000000-mapping.dmp
-
memory/2352-338-0x0000000007BA0000-0x0000000007BBC000-memory.dmpFilesize
112KB
-
memory/2352-327-0x0000000007BE0000-0x0000000007F30000-memory.dmpFilesize
3.3MB
-
memory/2352-320-0x0000000007A80000-0x0000000007AE6000-memory.dmpFilesize
408KB
-
memory/2352-399-0x00000000093A0000-0x00000000093D3000-memory.dmpFilesize
204KB
-
memory/2352-317-0x0000000007AF0000-0x0000000007B56000-memory.dmpFilesize
408KB
-
memory/2352-350-0x0000000008350000-0x00000000083C6000-memory.dmpFilesize
472KB
-
memory/2352-272-0x00000000071A0000-0x00000000077C8000-memory.dmpFilesize
6.2MB
-
memory/2352-260-0x0000000006B30000-0x0000000006B66000-memory.dmpFilesize
216KB
-
memory/2352-401-0x0000000009380000-0x000000000939E000-memory.dmpFilesize
120KB
-
memory/2352-412-0x00000000094E0000-0x0000000009585000-memory.dmpFilesize
660KB
-
memory/2352-416-0x00000000096B0000-0x0000000009744000-memory.dmpFilesize
592KB
-
memory/2352-626-0x0000000009650000-0x000000000966A000-memory.dmpFilesize
104KB
-
memory/3008-199-0x0000000000000000-mapping.dmp
-
memory/4060-341-0x0000000000000000-mapping.dmp