Analysis
-
max time kernel
150s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-09-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
4c1e61b0feb9caae2793253443f7898a0cb2312a8a367efb0233ee44f51f4feb.iso
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4c1e61b0feb9caae2793253443f7898a0cb2312a8a367efb0233ee44f51f4feb.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
VGM.exe
Resource
win7-20220812-en
General
-
Target
VGM.exe
-
Size
1.0MB
-
MD5
42b36510685fc45a71793137d2135903
-
SHA1
2e902541d787c4a9819078d2bb5fd7fa08f8a114
-
SHA256
7eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
-
SHA512
5638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
SSDEEP
24576:C33WTVxrYxIosanFLu3E61vo/Jtj/lpSmhTqH:Q6Vp9osKQPMvvSoe
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bin.exepid process 1772 bin.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 580 cmd.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
reg.exeInstallUtil.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Local\\bin.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bin.exedescription pid process target process PID 1772 set thread context of 748 1772 bin.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 1068 PING.EXE 1432 PING.EXE 940 PING.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
VGM.exebin.exeInstallUtil.exepid process 1008 VGM.exe 1008 VGM.exe 1008 VGM.exe 1772 bin.exe 1772 bin.exe 1772 bin.exe 748 InstallUtil.exe 748 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
VGM.exebin.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1008 VGM.exe Token: SeDebugPrivilege 1772 bin.exe Token: SeDebugPrivilege 748 InstallUtil.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
VGM.execmd.execmd.exebin.exeInstallUtil.exedescription pid process target process PID 1008 wrote to memory of 624 1008 VGM.exe cmd.exe PID 1008 wrote to memory of 624 1008 VGM.exe cmd.exe PID 1008 wrote to memory of 624 1008 VGM.exe cmd.exe PID 1008 wrote to memory of 624 1008 VGM.exe cmd.exe PID 624 wrote to memory of 1432 624 cmd.exe PING.EXE PID 624 wrote to memory of 1432 624 cmd.exe PING.EXE PID 624 wrote to memory of 1432 624 cmd.exe PING.EXE PID 624 wrote to memory of 1432 624 cmd.exe PING.EXE PID 1008 wrote to memory of 580 1008 VGM.exe cmd.exe PID 1008 wrote to memory of 580 1008 VGM.exe cmd.exe PID 1008 wrote to memory of 580 1008 VGM.exe cmd.exe PID 1008 wrote to memory of 580 1008 VGM.exe cmd.exe PID 580 wrote to memory of 940 580 cmd.exe PING.EXE PID 580 wrote to memory of 940 580 cmd.exe PING.EXE PID 580 wrote to memory of 940 580 cmd.exe PING.EXE PID 580 wrote to memory of 940 580 cmd.exe PING.EXE PID 624 wrote to memory of 1644 624 cmd.exe reg.exe PID 624 wrote to memory of 1644 624 cmd.exe reg.exe PID 624 wrote to memory of 1644 624 cmd.exe reg.exe PID 624 wrote to memory of 1644 624 cmd.exe reg.exe PID 580 wrote to memory of 1068 580 cmd.exe PING.EXE PID 580 wrote to memory of 1068 580 cmd.exe PING.EXE PID 580 wrote to memory of 1068 580 cmd.exe PING.EXE PID 580 wrote to memory of 1068 580 cmd.exe PING.EXE PID 580 wrote to memory of 1772 580 cmd.exe bin.exe PID 580 wrote to memory of 1772 580 cmd.exe bin.exe PID 580 wrote to memory of 1772 580 cmd.exe bin.exe PID 580 wrote to memory of 1772 580 cmd.exe bin.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 1636 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 1772 wrote to memory of 748 1772 bin.exe InstallUtil.exe PID 748 wrote to memory of 1628 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 1628 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 1628 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 1628 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 772 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 772 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 772 748 InstallUtil.exe schtasks.exe PID 748 wrote to memory of 772 748 InstallUtil.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VGM.exe"C:\Users\Admin\AppData\Local\Temp\VGM.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Local\Temp\VGM.exe" "C:\Users\Admin\AppData\Local\bin.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\AppData\Local\bin.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 203⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 203⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp24A1.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp25AC.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp24A1.tmpFilesize
1KB
MD5576bbaf398045c3843d452ec83208236
SHA18ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374
SHA25633c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b
SHA512e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a
-
C:\Users\Admin\AppData\Local\Temp\tmp25AC.tmpFilesize
1KB
MD54e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
C:\Users\Admin\AppData\Local\bin.exeFilesize
1.0MB
MD542b36510685fc45a71793137d2135903
SHA12e902541d787c4a9819078d2bb5fd7fa08f8a114
SHA2567eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
SHA5125638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
C:\Users\Admin\AppData\Local\bin.exeFilesize
1.0MB
MD542b36510685fc45a71793137d2135903
SHA12e902541d787c4a9819078d2bb5fd7fa08f8a114
SHA2567eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
SHA5125638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
\Users\Admin\AppData\Local\bin.exeFilesize
1.0MB
MD542b36510685fc45a71793137d2135903
SHA12e902541d787c4a9819078d2bb5fd7fa08f8a114
SHA2567eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
SHA5125638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
memory/580-59-0x0000000000000000-mapping.dmp
-
memory/624-57-0x0000000000000000-mapping.dmp
-
memory/748-94-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/748-86-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/748-96-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/748-84-0x000000000041E792-mapping.dmp
-
memory/748-97-0x0000000004925000-0x0000000004936000-memory.dmpFilesize
68KB
-
memory/748-83-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/748-88-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/748-95-0x0000000000440000-0x000000000045E000-memory.dmpFilesize
120KB
-
memory/772-92-0x0000000000000000-mapping.dmp
-
memory/940-60-0x0000000000000000-mapping.dmp
-
memory/1008-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1008-54-0x00000000003A0000-0x00000000004B2000-memory.dmpFilesize
1.1MB
-
memory/1008-56-0x0000000000550000-0x0000000000582000-memory.dmpFilesize
200KB
-
memory/1068-62-0x0000000000000000-mapping.dmp
-
memory/1432-58-0x0000000000000000-mapping.dmp
-
memory/1628-90-0x0000000000000000-mapping.dmp
-
memory/1636-75-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1636-72-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1636-74-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1636-71-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1644-61-0x0000000000000000-mapping.dmp
-
memory/1772-70-0x0000000000620000-0x0000000000626000-memory.dmpFilesize
24KB
-
memory/1772-69-0x0000000000600000-0x000000000061A000-memory.dmpFilesize
104KB
-
memory/1772-67-0x0000000000090000-0x00000000001A2000-memory.dmpFilesize
1.1MB
-
memory/1772-64-0x0000000000000000-mapping.dmp