Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
BL No.KTOHRYGN2202 (SURRENDERED BL).exe
Resource
win7-20220812-en
General
-
Target
BL No.KTOHRYGN2202 (SURRENDERED BL).exe
-
Size
674KB
-
MD5
69b22379d46d4c2a2dc362e4007bea3d
-
SHA1
d37900a359f9b48802aea91405e3d5294e9a872f
-
SHA256
fe910e56eb88b734e4464a006324b15804237b40c2f7ad843bd9f419c65d5df9
-
SHA512
7db2405fd5ac092939cf1ecbd4782a854d702e26757e22ce1095d7fbee349cb01726d927b852ce84b373337dedac32c5b9d35a9f64d19ffc719de9847c98ed83
-
SSDEEP
12288:27oCLq8V6og3rMfxPjnMp1cdap17rGPZVnoles0EeVljP5ruP5z0aIXWX6H:27DLq8Vk0ZMpyczr0ZSAEENuP5ogO
Malware Config
Extracted
nanocore
1.2.2.0
godisgood1.hopto.org:7712
185.225.73.164:7712
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
-
activate_away_mode
true
-
backup_connection_host
185.225.73.164
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-05-24T09:37:49.129028236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7712
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
godisgood1.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe" BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription pid process target process PID 1588 set thread context of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Drops file in Program Files directory 2 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exedescription ioc process File created C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe File opened for modification C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1016 schtasks.exe 1332 schtasks.exe 3888 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeBL No.KTOHRYGN2202 (SURRENDERED BL).exepid process 2664 powershell.exe 2664 powershell.exe 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exepid process 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeBL No.KTOHRYGN2202 (SURRENDERED BL).exedescription pid process Token: SeDebugPrivilege 2664 powershell.exe Token: SeDebugPrivilege 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
BL No.KTOHRYGN2202 (SURRENDERED BL).exeBL No.KTOHRYGN2202 (SURRENDERED BL).exedescription pid process target process PID 1588 wrote to memory of 2664 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1588 wrote to memory of 2664 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1588 wrote to memory of 2664 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe powershell.exe PID 1588 wrote to memory of 1016 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1588 wrote to memory of 1016 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1588 wrote to memory of 1016 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 1588 wrote to memory of 4852 1588 BL No.KTOHRYGN2202 (SURRENDERED BL).exe BL No.KTOHRYGN2202 (SURRENDERED BL).exe PID 4852 wrote to memory of 1332 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 4852 wrote to memory of 1332 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 4852 wrote to memory of 1332 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 4852 wrote to memory of 3888 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 4852 wrote to memory of 3888 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe PID 4852 wrote to memory of 3888 4852 BL No.KTOHRYGN2202 (SURRENDERED BL).exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qLCTUoBHeGs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qLCTUoBHeGs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E5A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"C:\Users\Admin\AppData\Local\Temp\BL No.KTOHRYGN2202 (SURRENDERED BL).exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp734B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp73BA.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6E5A.tmpFilesize
1KB
MD507ed8c10d3bb88cd112c289dd44de3ee
SHA19ae7e4cd6338cfe52bee781de4be60edd6225795
SHA25674ee48ef0e8c1fde67542d2368beace0ea60853ae60c86f4f149c77d16bd9d54
SHA5126878a8909854b9541475f095abe9685c15ca70480611b4e8a0c5df36b18fcf601a02347263cdfa9281748688c3adfc8baef5a74785675ea64627768e54712c4d
-
C:\Users\Admin\AppData\Local\Temp\tmp734B.tmpFilesize
1KB
MD5fb9a885116c4a98b541ce16a95960dc5
SHA1ccfc56e6fa5950c958d95f0323e4e484d72b013a
SHA256bf14c137b166e3a53be44a9a046294bc1c07e885e01bbb26d1744ad38680ebde
SHA512fa7c6720571aad9979b0a69cc41cc805ea52a65f37c10ba756bafe5a37961973d90c55a3d1a39f179637f5ebca5467950d9b7befd53cdcb81416a8e64ef56f78
-
C:\Users\Admin\AppData\Local\Temp\tmp73BA.tmpFilesize
1KB
MD52f26d92c1eeead3896820e56ec46f6f1
SHA1d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA25699a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
SHA5126c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
-
memory/1016-141-0x0000000000000000-mapping.dmp
-
memory/1332-150-0x0000000000000000-mapping.dmp
-
memory/1588-135-0x00000000008E0000-0x000000000098E000-memory.dmpFilesize
696KB
-
memory/1588-136-0x0000000005920000-0x0000000005EC4000-memory.dmpFilesize
5.6MB
-
memory/1588-137-0x0000000005370000-0x0000000005402000-memory.dmpFilesize
584KB
-
memory/1588-138-0x0000000005320000-0x000000000532A000-memory.dmpFilesize
40KB
-
memory/1588-139-0x0000000008E60000-0x0000000008EFC000-memory.dmpFilesize
624KB
-
memory/2664-149-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/2664-158-0x0000000007C40000-0x00000000082BA000-memory.dmpFilesize
6.5MB
-
memory/2664-147-0x0000000005B70000-0x0000000005B92000-memory.dmpFilesize
136KB
-
memory/2664-148-0x0000000005C10000-0x0000000005C76000-memory.dmpFilesize
408KB
-
memory/2664-146-0x0000000005540000-0x0000000005B68000-memory.dmpFilesize
6.2MB
-
memory/2664-164-0x0000000007920000-0x0000000007928000-memory.dmpFilesize
32KB
-
memory/2664-143-0x00000000029D0000-0x0000000002A06000-memory.dmpFilesize
216KB
-
memory/2664-163-0x0000000007940000-0x000000000795A000-memory.dmpFilesize
104KB
-
memory/2664-153-0x00000000062F0000-0x000000000630E000-memory.dmpFilesize
120KB
-
memory/2664-140-0x0000000000000000-mapping.dmp
-
memory/2664-155-0x00000000068C0000-0x00000000068F2000-memory.dmpFilesize
200KB
-
memory/2664-156-0x0000000071110000-0x000000007115C000-memory.dmpFilesize
304KB
-
memory/2664-157-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/2664-162-0x0000000007830000-0x000000000783E000-memory.dmpFilesize
56KB
-
memory/2664-159-0x00000000075F0000-0x000000000760A000-memory.dmpFilesize
104KB
-
memory/2664-160-0x0000000007680000-0x000000000768A000-memory.dmpFilesize
40KB
-
memory/2664-161-0x0000000007880000-0x0000000007916000-memory.dmpFilesize
600KB
-
memory/3888-152-0x0000000000000000-mapping.dmp
-
memory/4852-144-0x0000000000000000-mapping.dmp
-
memory/4852-145-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB