Analysis
-
max time kernel
155s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2022 05:13
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.CrypterX-gen.27794.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.CrypterX-gen.27794.exe
-
Size
564KB
-
MD5
d2511f548930bc0a616afb4bf2f5eb59
-
SHA1
dfd9d5479816b67c213fa35f87280c192d1a20a1
-
SHA256
d867f1bbf4a3d8e8de9ce9c75d7d1690a9ab15ba919ed0d01f6bc66683e074c4
-
SHA512
e9922aefdd68bfbb1773ccf75f2412af987e67570d876bfd99aee5fd46c616a430fe8ec9fc1917a797ca3d433d94cc81e87ca5fe8eea38638361b4bbacd6651e
-
SSDEEP
12288:g8l02b1zzUFFiRUUWgSXGjITqZfs+Bog:blfzzUFAKDlW8Tqf
Malware Config
Extracted
nanocore
1.2.2.0
brewsterchristophe.ddns.net:5899
194,147,5,75:5899
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
-
activate_away_mode
true
-
backup_connection_host
194,147,5,75
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-04-29T03:26:40.572298236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5899
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
brewsterchristophe.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Bin.exepid process 3500 Bin.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
reg.exeRegAsm.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bin = "C:\\Users\\Admin\\Desktop\\Bin.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bin.exedescription pid process target process PID 3500 set thread context of 1204 3500 Bin.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3464 schtasks.exe 4664 schtasks.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 4380 PING.EXE 4328 PING.EXE 4196 PING.EXE -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.27794.exeBin.exeRegAsm.exepid process 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe 3500 Bin.exe 3500 Bin.exe 3500 Bin.exe 3500 Bin.exe 3500 Bin.exe 3500 Bin.exe 1204 RegAsm.exe 1204 RegAsm.exe 1204 RegAsm.exe 1204 RegAsm.exe 1204 RegAsm.exe 1204 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1204 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.27794.exeBin.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe Token: SeDebugPrivilege 3500 Bin.exe Token: SeDebugPrivilege 1204 RegAsm.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.27794.execmd.execmd.exeBin.exeRegAsm.exedescription pid process target process PID 2304 wrote to memory of 2924 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe cmd.exe PID 2304 wrote to memory of 2924 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe cmd.exe PID 2304 wrote to memory of 2924 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe cmd.exe PID 2924 wrote to memory of 4196 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 4196 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 4196 2924 cmd.exe PING.EXE PID 2304 wrote to memory of 3760 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe cmd.exe PID 2304 wrote to memory of 3760 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe cmd.exe PID 2304 wrote to memory of 3760 2304 SecuriteInfo.com.Win32.CrypterX-gen.27794.exe cmd.exe PID 3760 wrote to memory of 4380 3760 cmd.exe PING.EXE PID 3760 wrote to memory of 4380 3760 cmd.exe PING.EXE PID 3760 wrote to memory of 4380 3760 cmd.exe PING.EXE PID 2924 wrote to memory of 3280 2924 cmd.exe reg.exe PID 2924 wrote to memory of 3280 2924 cmd.exe reg.exe PID 2924 wrote to memory of 3280 2924 cmd.exe reg.exe PID 3760 wrote to memory of 4328 3760 cmd.exe PING.EXE PID 3760 wrote to memory of 4328 3760 cmd.exe PING.EXE PID 3760 wrote to memory of 4328 3760 cmd.exe PING.EXE PID 3760 wrote to memory of 3500 3760 cmd.exe Bin.exe PID 3760 wrote to memory of 3500 3760 cmd.exe Bin.exe PID 3760 wrote to memory of 3500 3760 cmd.exe Bin.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 228 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 3300 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 3500 wrote to memory of 1204 3500 Bin.exe RegAsm.exe PID 1204 wrote to memory of 3464 1204 RegAsm.exe schtasks.exe PID 1204 wrote to memory of 3464 1204 RegAsm.exe schtasks.exe PID 1204 wrote to memory of 3464 1204 RegAsm.exe schtasks.exe PID 1204 wrote to memory of 4664 1204 RegAsm.exe schtasks.exe PID 1204 wrote to memory of 4664 1204 RegAsm.exe schtasks.exe PID 1204 wrote to memory of 4664 1204 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.27794.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.27794.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\Desktop\Bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 133⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\Desktop\Bin.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.27794.exe" "C:\Users\Admin\Desktop\Bin.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\Desktop\Bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 183⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 183⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\Bin.exe"C:\Users\Admin\Desktop\Bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2FD0.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp304E.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2FD0.tmpFilesize
1KB
MD548ef7fa9033389ad7929d7a6b9d10298
SHA19db6cb7325c8bdf66a15f7b5f34703709a45aeb6
SHA2560c1b5f67eeb276d1d4205b138ce32bc6149924e02281a2db8e4623a700e88f15
SHA512ac8bd104ecbacc9bccce9e087f67e5b18072d59367ccd31d4e66132b6baaea520cba5b9b59464483d86abf74826b382c402f12e9a586c99bda8c78a0de33944e
-
C:\Users\Admin\AppData\Local\Temp\tmp304E.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
C:\Users\Admin\Desktop\Bin.exeFilesize
564KB
MD5d2511f548930bc0a616afb4bf2f5eb59
SHA1dfd9d5479816b67c213fa35f87280c192d1a20a1
SHA256d867f1bbf4a3d8e8de9ce9c75d7d1690a9ab15ba919ed0d01f6bc66683e074c4
SHA512e9922aefdd68bfbb1773ccf75f2412af987e67570d876bfd99aee5fd46c616a430fe8ec9fc1917a797ca3d433d94cc81e87ca5fe8eea38638361b4bbacd6651e
-
C:\Users\Admin\Desktop\Bin.exeFilesize
564KB
MD5d2511f548930bc0a616afb4bf2f5eb59
SHA1dfd9d5479816b67c213fa35f87280c192d1a20a1
SHA256d867f1bbf4a3d8e8de9ce9c75d7d1690a9ab15ba919ed0d01f6bc66683e074c4
SHA512e9922aefdd68bfbb1773ccf75f2412af987e67570d876bfd99aee5fd46c616a430fe8ec9fc1917a797ca3d433d94cc81e87ca5fe8eea38638361b4bbacd6651e
-
memory/228-147-0x0000000000000000-mapping.dmp
-
memory/1204-150-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1204-149-0x0000000000000000-mapping.dmp
-
memory/1204-155-0x0000000006E90000-0x0000000006EF6000-memory.dmpFilesize
408KB
-
memory/2304-133-0x0000000004B20000-0x0000000004BBC000-memory.dmpFilesize
624KB
-
memory/2304-134-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/2304-136-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/2304-132-0x0000000000F50000-0x0000000000FE2000-memory.dmpFilesize
584KB
-
memory/2304-135-0x0000000005990000-0x0000000005A22000-memory.dmpFilesize
584KB
-
memory/2924-137-0x0000000000000000-mapping.dmp
-
memory/3280-141-0x0000000000000000-mapping.dmp
-
memory/3300-148-0x0000000000000000-mapping.dmp
-
memory/3464-151-0x0000000000000000-mapping.dmp
-
memory/3500-146-0x0000000000CF0000-0x0000000000D82000-memory.dmpFilesize
584KB
-
memory/3500-143-0x0000000000000000-mapping.dmp
-
memory/3760-139-0x0000000000000000-mapping.dmp
-
memory/4196-138-0x0000000000000000-mapping.dmp
-
memory/4328-142-0x0000000000000000-mapping.dmp
-
memory/4380-140-0x0000000000000000-mapping.dmp
-
memory/4664-153-0x0000000000000000-mapping.dmp