Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2022 02:30
Static task
static1
Behavioral task
behavioral1
Sample
720d088da9cafaad486c347e0d09f696.exe
Resource
win7-20220812-en
General
-
Target
720d088da9cafaad486c347e0d09f696.exe
-
Size
564KB
-
MD5
720d088da9cafaad486c347e0d09f696
-
SHA1
9b751c34f71bb40b050dab0592ff45be56a602ad
-
SHA256
a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931
-
SHA512
44addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30
-
SSDEEP
12288:48l02b1zzUFFiRU9WnSmzxwTqZfs+0K+:TlfzzUFAKASmyTqY
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Bin.exepid process 1296 Bin.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
reg.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bin = "C:\\Users\\Admin\\AppData\\Local\\Bin.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bin.exedescription pid process target process PID 1296 set thread context of 2336 1296 Bin.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe InstallUtil.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2000 schtasks.exe 3740 schtasks.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 3980 PING.EXE 4744 PING.EXE 4296 PING.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
720d088da9cafaad486c347e0d09f696.exeBin.exeInstallUtil.exepid process 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 3956 720d088da9cafaad486c347e0d09f696.exe 1296 Bin.exe 1296 Bin.exe 2336 InstallUtil.exe 2336 InstallUtil.exe 2336 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 2336 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
720d088da9cafaad486c347e0d09f696.exeBin.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3956 720d088da9cafaad486c347e0d09f696.exe Token: SeDebugPrivilege 1296 Bin.exe Token: SeDebugPrivilege 2336 InstallUtil.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
720d088da9cafaad486c347e0d09f696.execmd.execmd.exeBin.exeInstallUtil.exedescription pid process target process PID 3956 wrote to memory of 64 3956 720d088da9cafaad486c347e0d09f696.exe cmd.exe PID 3956 wrote to memory of 64 3956 720d088da9cafaad486c347e0d09f696.exe cmd.exe PID 3956 wrote to memory of 64 3956 720d088da9cafaad486c347e0d09f696.exe cmd.exe PID 64 wrote to memory of 4744 64 cmd.exe PING.EXE PID 64 wrote to memory of 4744 64 cmd.exe PING.EXE PID 64 wrote to memory of 4744 64 cmd.exe PING.EXE PID 3956 wrote to memory of 3756 3956 720d088da9cafaad486c347e0d09f696.exe cmd.exe PID 3956 wrote to memory of 3756 3956 720d088da9cafaad486c347e0d09f696.exe cmd.exe PID 3956 wrote to memory of 3756 3956 720d088da9cafaad486c347e0d09f696.exe cmd.exe PID 3756 wrote to memory of 4296 3756 cmd.exe PING.EXE PID 3756 wrote to memory of 4296 3756 cmd.exe PING.EXE PID 3756 wrote to memory of 4296 3756 cmd.exe PING.EXE PID 64 wrote to memory of 3948 64 cmd.exe reg.exe PID 64 wrote to memory of 3948 64 cmd.exe reg.exe PID 64 wrote to memory of 3948 64 cmd.exe reg.exe PID 3756 wrote to memory of 3980 3756 cmd.exe PING.EXE PID 3756 wrote to memory of 3980 3756 cmd.exe PING.EXE PID 3756 wrote to memory of 3980 3756 cmd.exe PING.EXE PID 3756 wrote to memory of 1296 3756 cmd.exe Bin.exe PID 3756 wrote to memory of 1296 3756 cmd.exe Bin.exe PID 3756 wrote to memory of 1296 3756 cmd.exe Bin.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 1296 wrote to memory of 2336 1296 Bin.exe InstallUtil.exe PID 2336 wrote to memory of 2000 2336 InstallUtil.exe schtasks.exe PID 2336 wrote to memory of 2000 2336 InstallUtil.exe schtasks.exe PID 2336 wrote to memory of 2000 2336 InstallUtil.exe schtasks.exe PID 2336 wrote to memory of 3740 2336 InstallUtil.exe schtasks.exe PID 2336 wrote to memory of 3740 2336 InstallUtil.exe schtasks.exe PID 2336 wrote to memory of 3740 2336 InstallUtil.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\720d088da9cafaad486c347e0d09f696.exe"C:\Users\Admin\AppData\Local\Temp\720d088da9cafaad486c347e0d09f696.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Bin.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\Users\Admin\AppData\Local\Temp\720d088da9cafaad486c347e0d09f696.exe" "C:\Users\Admin\AppData\Local\Bin.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\AppData\Local\Bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 193⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 193⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Bin.exe"C:\Users\Admin\AppData\Local\Bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD1A.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF9C.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Bin.exeFilesize
564KB
MD5720d088da9cafaad486c347e0d09f696
SHA19b751c34f71bb40b050dab0592ff45be56a602ad
SHA256a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931
SHA51244addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30
-
C:\Users\Admin\AppData\Local\Bin.exeFilesize
564KB
MD5720d088da9cafaad486c347e0d09f696
SHA19b751c34f71bb40b050dab0592ff45be56a602ad
SHA256a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931
SHA51244addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30
-
C:\Users\Admin\AppData\Local\Temp\tmpD1A.tmpFilesize
1KB
MD5576bbaf398045c3843d452ec83208236
SHA18ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374
SHA25633c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b
SHA512e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a
-
C:\Users\Admin\AppData\Local\Temp\tmpF9C.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
memory/64-137-0x0000000000000000-mapping.dmp
-
memory/1296-143-0x0000000000000000-mapping.dmp
-
memory/1296-146-0x00000000003B0000-0x0000000000442000-memory.dmpFilesize
584KB
-
memory/2000-149-0x0000000000000000-mapping.dmp
-
memory/2336-147-0x0000000000000000-mapping.dmp
-
memory/2336-148-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3740-151-0x0000000000000000-mapping.dmp
-
memory/3756-139-0x0000000000000000-mapping.dmp
-
memory/3948-141-0x0000000000000000-mapping.dmp
-
memory/3956-136-0x00000000062B0000-0x00000000062BA000-memory.dmpFilesize
40KB
-
memory/3956-132-0x0000000000800000-0x0000000000892000-memory.dmpFilesize
584KB
-
memory/3956-135-0x0000000006120000-0x00000000061B2000-memory.dmpFilesize
584KB
-
memory/3956-134-0x00000000064F0000-0x0000000006A94000-memory.dmpFilesize
5.6MB
-
memory/3956-133-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB
-
memory/3980-142-0x0000000000000000-mapping.dmp
-
memory/4296-140-0x0000000000000000-mapping.dmp
-
memory/4744-138-0x0000000000000000-mapping.dmp