Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
4c1e61b0feb9caae2793253443f7898a0cb2312a8a367efb0233ee44f51f4feb.iso
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4c1e61b0feb9caae2793253443f7898a0cb2312a8a367efb0233ee44f51f4feb.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
VGM.exe
Resource
win7-20220812-en
General
-
Target
VGM.exe
-
Size
1.0MB
-
MD5
42b36510685fc45a71793137d2135903
-
SHA1
2e902541d787c4a9819078d2bb5fd7fa08f8a114
-
SHA256
7eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
-
SHA512
5638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
SSDEEP
24576:C33WTVxrYxIosanFLu3E61vo/Jtj/lpSmhTqH:Q6Vp9osKQPMvvSoe
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bin.exepid process 3496 bin.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
reg.exeInstallUtil.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Local\\bin.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bin.exedescription pid process target process PID 3496 set thread context of 2168 3496 bin.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3436 schtasks.exe 4776 schtasks.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 3920 PING.EXE 2904 PING.EXE 3708 PING.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
VGM.exebin.exeInstallUtil.exepid process 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 1176 VGM.exe 3496 bin.exe 3496 bin.exe 3496 bin.exe 3496 bin.exe 3496 bin.exe 3496 bin.exe 2168 InstallUtil.exe 2168 InstallUtil.exe 2168 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 2168 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
VGM.exebin.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1176 VGM.exe Token: SeDebugPrivilege 3496 bin.exe Token: SeDebugPrivilege 2168 InstallUtil.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
VGM.execmd.execmd.exebin.exeInstallUtil.exedescription pid process target process PID 1176 wrote to memory of 3068 1176 VGM.exe cmd.exe PID 1176 wrote to memory of 3068 1176 VGM.exe cmd.exe PID 1176 wrote to memory of 3068 1176 VGM.exe cmd.exe PID 3068 wrote to memory of 3920 3068 cmd.exe PING.EXE PID 3068 wrote to memory of 3920 3068 cmd.exe PING.EXE PID 3068 wrote to memory of 3920 3068 cmd.exe PING.EXE PID 1176 wrote to memory of 4140 1176 VGM.exe cmd.exe PID 1176 wrote to memory of 4140 1176 VGM.exe cmd.exe PID 1176 wrote to memory of 4140 1176 VGM.exe cmd.exe PID 4140 wrote to memory of 2904 4140 cmd.exe PING.EXE PID 4140 wrote to memory of 2904 4140 cmd.exe PING.EXE PID 4140 wrote to memory of 2904 4140 cmd.exe PING.EXE PID 3068 wrote to memory of 2424 3068 cmd.exe reg.exe PID 3068 wrote to memory of 2424 3068 cmd.exe reg.exe PID 3068 wrote to memory of 2424 3068 cmd.exe reg.exe PID 4140 wrote to memory of 3708 4140 cmd.exe PING.EXE PID 4140 wrote to memory of 3708 4140 cmd.exe PING.EXE PID 4140 wrote to memory of 3708 4140 cmd.exe PING.EXE PID 4140 wrote to memory of 3496 4140 cmd.exe bin.exe PID 4140 wrote to memory of 3496 4140 cmd.exe bin.exe PID 4140 wrote to memory of 3496 4140 cmd.exe bin.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 3524 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 4004 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 3496 wrote to memory of 2168 3496 bin.exe InstallUtil.exe PID 2168 wrote to memory of 3436 2168 InstallUtil.exe schtasks.exe PID 2168 wrote to memory of 3436 2168 InstallUtil.exe schtasks.exe PID 2168 wrote to memory of 3436 2168 InstallUtil.exe schtasks.exe PID 2168 wrote to memory of 4776 2168 InstallUtil.exe schtasks.exe PID 2168 wrote to memory of 4776 2168 InstallUtil.exe schtasks.exe PID 2168 wrote to memory of 4776 2168 InstallUtil.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VGM.exe"C:\Users\Admin\AppData\Local\Temp\VGM.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 93⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\VGM.exe" "C:\Users\Admin\AppData\Local\bin.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\AppData\Local\bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 133⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 133⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC4A8.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC564.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC4A8.tmpFilesize
1KB
MD5576bbaf398045c3843d452ec83208236
SHA18ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374
SHA25633c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b
SHA512e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a
-
C:\Users\Admin\AppData\Local\Temp\tmpC564.tmpFilesize
1KB
MD52f26d92c1eeead3896820e56ec46f6f1
SHA1d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA25699a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
SHA5126c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
-
C:\Users\Admin\AppData\Local\bin.exeFilesize
1.0MB
MD542b36510685fc45a71793137d2135903
SHA12e902541d787c4a9819078d2bb5fd7fa08f8a114
SHA2567eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
SHA5125638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
C:\Users\Admin\AppData\Local\bin.exeFilesize
1.0MB
MD542b36510685fc45a71793137d2135903
SHA12e902541d787c4a9819078d2bb5fd7fa08f8a114
SHA2567eb71646534a4c45b2d8dce8f41bccd7a1acfd3a8e3171eb287c500b9426724d
SHA5125638886956740d42eb2ddeb1410f0ecae8259b15227d467caa1e23a64192a94f1e6ae29c470f1f2d9e5ca42a67f34f2f85c03a825acc8d07252777b0c0d74533
-
memory/1176-136-0x0000000008BF0000-0x0000000008BFA000-memory.dmpFilesize
40KB
-
memory/1176-135-0x0000000008C00000-0x0000000008C92000-memory.dmpFilesize
584KB
-
memory/1176-134-0x0000000008E80000-0x0000000009424000-memory.dmpFilesize
5.6MB
-
memory/1176-133-0x00000000055A0000-0x000000000563C000-memory.dmpFilesize
624KB
-
memory/1176-132-0x0000000000630000-0x0000000000742000-memory.dmpFilesize
1.1MB
-
memory/2168-149-0x0000000000000000-mapping.dmp
-
memory/2168-150-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2424-141-0x0000000000000000-mapping.dmp
-
memory/2904-140-0x0000000000000000-mapping.dmp
-
memory/3068-137-0x0000000000000000-mapping.dmp
-
memory/3436-151-0x0000000000000000-mapping.dmp
-
memory/3496-143-0x0000000000000000-mapping.dmp
-
memory/3496-146-0x0000000000E00000-0x0000000000F12000-memory.dmpFilesize
1.1MB
-
memory/3524-147-0x0000000000000000-mapping.dmp
-
memory/3708-142-0x0000000000000000-mapping.dmp
-
memory/3920-138-0x0000000000000000-mapping.dmp
-
memory/4004-148-0x0000000000000000-mapping.dmp
-
memory/4140-139-0x0000000000000000-mapping.dmp
-
memory/4776-153-0x0000000000000000-mapping.dmp