Analysis
-
max time kernel
95s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-09-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
BL No.KTOHRYGN2202 (SURRENDERED BL).exe
Resource
win7-20220812-en
General
-
Target
BL No.KTOHRYGN2202 (SURRENDERED BL).exe
-
Size
674KB
-
MD5
69b22379d46d4c2a2dc362e4007bea3d
-
SHA1
d37900a359f9b48802aea91405e3d5294e9a872f
-
SHA256
fe910e56eb88b734e4464a006324b15804237b40c2f7ad843bd9f419c65d5df9
-
SHA512
7db2405fd5ac092939cf1ecbd4782a854d702e26757e22ce1095d7fbee349cb01726d927b852ce84b373337dedac32c5b9d35a9f64d19ffc719de9847c98ed83
-
SSDEEP
12288:27oCLq8V6og3rMfxPjnMp1cdap17rGPZVnoles0EeVljP5ruP5z0aIXWX6H:27DLq8Vk0ZMpyczr0ZSAEENuP5ogO
Malware Config
Extracted
nanocore
1.2.2.0
godisgood1.hopto.org:7712
185.225.73.164:7712
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
-
activate_away_mode
true
-
backup_connection_host
185.225.73.164
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-05-24T09:37:49.129028236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7712
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
godisgood1.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe" BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription pid process target process PID 1972 set thread context of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Drops file in Program Files directory 2 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process File created C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe File opened for modification C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 896 schtasks.exe 852 schtasks.exe 624 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exepowershell.exeBL No.KTOHRYGN2202 (SURRENDERED BL).exepid process 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 1716 powershell.exe 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exepid process 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exepowershell.exeBL No.KTOHRYGN2202 (SURRENDERED BL).exedescription pid process Token: SeDebugPrivilege 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exeBL No.KTOHRYGN2202 (SURRENDERED BL).exedescription pid process target process PID 1972 wrote to memory of 1716 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1972 wrote to memory of 1716 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1972 wrote to memory of 1716 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1972 wrote to memory of 1716 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1972 wrote to memory of 896 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1972 wrote to memory of 896 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1972 wrote to memory of 896 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1972 wrote to memory of 896 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1972 wrote to memory of 1212 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1212 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1212 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1212 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 568 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 568 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 568 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 568 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1972 wrote to memory of 1876 1972 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1876 wrote to memory of 852 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 852 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 852 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 852 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 624 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 624 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 624 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1876 wrote to memory of 624 1876 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qLCTUoBHeGs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qLCTUoBHeGs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC0B1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC514.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC60F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC0B1.tmpFilesize
1KB
MD529e7f7c67dd13f5c66938923b14da644
SHA164fc190a013f73d6dc94294b16ff4eda77052869
SHA2566d1bb5057fae112da1f689229dacafb4c25e6e1d09f8c2b058cc5e00fe575856
SHA512a98ba0b2d8a255f64a59d1fd3a8b96c2db29dcaa9d5ca22ffd2f52588e42364bb413244332501b949ff77688749774ea0c06ce0d0b52797ee905a6e8911294f1
-
C:\Users\Admin\AppData\Local\Temp\tmpC514.tmpFilesize
1KB
MD5fb9a885116c4a98b541ce16a95960dc5
SHA1ccfc56e6fa5950c958d95f0323e4e484d72b013a
SHA256bf14c137b166e3a53be44a9a046294bc1c07e885e01bbb26d1744ad38680ebde
SHA512fa7c6720571aad9979b0a69cc41cc805ea52a65f37c10ba756bafe5a37961973d90c55a3d1a39f179637f5ebca5467950d9b7befd53cdcb81416a8e64ef56f78
-
C:\Users\Admin\AppData\Local\Temp\tmpC60F.tmpFilesize
1KB
MD5981e126601526eaa5b0ad45c496c4465
SHA1d610d6a21a8420cc73fcd3e54ddae75a5897b28b
SHA25611ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527
SHA512a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb
-
memory/624-79-0x0000000000000000-mapping.dmp
-
memory/852-77-0x0000000000000000-mapping.dmp
-
memory/896-60-0x0000000000000000-mapping.dmp
-
memory/1716-97-0x000000006F3B0000-0x000000006F95B000-memory.dmpFilesize
5.7MB
-
memory/1716-81-0x000000006F3B0000-0x000000006F95B000-memory.dmpFilesize
5.7MB
-
memory/1716-59-0x0000000000000000-mapping.dmp
-
memory/1876-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-91-0x0000000000910000-0x0000000000924000-memory.dmpFilesize
80KB
-
memory/1876-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-73-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-71-0x000000000041E792-mapping.dmp
-
memory/1876-75-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1876-96-0x0000000000A60000-0x0000000000A74000-memory.dmpFilesize
80KB
-
memory/1876-95-0x0000000004840000-0x000000000486E000-memory.dmpFilesize
184KB
-
memory/1876-94-0x0000000000950000-0x000000000095E000-memory.dmpFilesize
56KB
-
memory/1876-93-0x0000000000930000-0x0000000000944000-memory.dmpFilesize
80KB
-
memory/1876-92-0x0000000000920000-0x0000000000930000-memory.dmpFilesize
64KB
-
memory/1876-82-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/1876-83-0x0000000000680000-0x000000000069E000-memory.dmpFilesize
120KB
-
memory/1876-84-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/1876-85-0x00000000006B0000-0x00000000006C2000-memory.dmpFilesize
72KB
-
memory/1876-86-0x00000000006E0000-0x00000000006FA000-memory.dmpFilesize
104KB
-
memory/1876-87-0x0000000000800000-0x000000000080E000-memory.dmpFilesize
56KB
-
memory/1876-88-0x0000000000860000-0x0000000000872000-memory.dmpFilesize
72KB
-
memory/1876-89-0x00000000008B0000-0x00000000008BC000-memory.dmpFilesize
48KB
-
memory/1876-90-0x0000000000900000-0x000000000090E000-memory.dmpFilesize
56KB
-
memory/1876-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-56-0x0000000000510000-0x0000000000528000-memory.dmpFilesize
96KB
-
memory/1972-57-0x0000000000570000-0x000000000057C000-memory.dmpFilesize
48KB
-
memory/1972-58-0x0000000005DB0000-0x0000000005E38000-memory.dmpFilesize
544KB
-
memory/1972-63-0x0000000004DD0000-0x0000000004E0A000-memory.dmpFilesize
232KB
-
memory/1972-54-0x0000000000220000-0x00000000002CE000-memory.dmpFilesize
696KB
-
memory/1972-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB