Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2022 10:18
Static task
static1
Behavioral task
behavioral1
Sample
Re Remittance Advice.exe
Resource
win7-20220901-en
General
-
Target
Re Remittance Advice.exe
-
Size
566KB
-
MD5
0f69b38426bbbcb5528aaef9d7d6e054
-
SHA1
bbc0cec1892e41a0d854b33bf8d8f156367caf6b
-
SHA256
24584863e35b36fa2cd4285a6aafd6a117ea0585c5c92ddf289ab13b8af87622
-
SHA512
21bc78a63dc7aa27500261d43747ccf5589a95ebf9a866f7e68bdc8ec89c573a9352e1af438cb8360a29ceee63fb6788841f0f3399159e1f0069bd17abf59df8
-
SSDEEP
12288:XO8l02b1zzUFFiRU8WnSSW/FnILBTqZfs+StQPI:NlfzzUFAKLSSW+LBTq3A
Malware Config
Extracted
nanocore
1.2.2.0
brightnano1.ddns.net:1989
171.22.30.97:1989
fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe
-
activate_away_mode
true
-
backup_connection_host
171.22.30.97
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-10T14:34:05.030247036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1989
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
brightnano1.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Bin.exepid process 372 Bin.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
reg.exeRegAsm.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bin = "C:\\Users\\Admin\\Desktop\\Bin.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bin.exedescription pid process target process PID 372 set thread context of 4324 372 Bin.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3940 schtasks.exe 4308 schtasks.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 4132 PING.EXE 4872 PING.EXE 3144 PING.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
Re Remittance Advice.exeBin.exeRegAsm.exepid process 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 4564 Re Remittance Advice.exe 372 Bin.exe 372 Bin.exe 4324 RegAsm.exe 4324 RegAsm.exe 4324 RegAsm.exe 4324 RegAsm.exe 4324 RegAsm.exe 4324 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 4324 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Re Remittance Advice.exeBin.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4564 Re Remittance Advice.exe Token: SeDebugPrivilege 372 Bin.exe Token: SeDebugPrivilege 4324 RegAsm.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
Re Remittance Advice.execmd.execmd.exeBin.exeRegAsm.exedescription pid process target process PID 4564 wrote to memory of 4788 4564 Re Remittance Advice.exe cmd.exe PID 4564 wrote to memory of 4788 4564 Re Remittance Advice.exe cmd.exe PID 4564 wrote to memory of 4788 4564 Re Remittance Advice.exe cmd.exe PID 4788 wrote to memory of 3144 4788 cmd.exe PING.EXE PID 4788 wrote to memory of 3144 4788 cmd.exe PING.EXE PID 4788 wrote to memory of 3144 4788 cmd.exe PING.EXE PID 4564 wrote to memory of 3092 4564 Re Remittance Advice.exe cmd.exe PID 4564 wrote to memory of 3092 4564 Re Remittance Advice.exe cmd.exe PID 4564 wrote to memory of 3092 4564 Re Remittance Advice.exe cmd.exe PID 3092 wrote to memory of 4132 3092 cmd.exe PING.EXE PID 3092 wrote to memory of 4132 3092 cmd.exe PING.EXE PID 3092 wrote to memory of 4132 3092 cmd.exe PING.EXE PID 4788 wrote to memory of 4032 4788 cmd.exe reg.exe PID 4788 wrote to memory of 4032 4788 cmd.exe reg.exe PID 4788 wrote to memory of 4032 4788 cmd.exe reg.exe PID 3092 wrote to memory of 4872 3092 cmd.exe PING.EXE PID 3092 wrote to memory of 4872 3092 cmd.exe PING.EXE PID 3092 wrote to memory of 4872 3092 cmd.exe PING.EXE PID 3092 wrote to memory of 372 3092 cmd.exe Bin.exe PID 3092 wrote to memory of 372 3092 cmd.exe Bin.exe PID 3092 wrote to memory of 372 3092 cmd.exe Bin.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 372 wrote to memory of 4324 372 Bin.exe RegAsm.exe PID 4324 wrote to memory of 3940 4324 RegAsm.exe schtasks.exe PID 4324 wrote to memory of 3940 4324 RegAsm.exe schtasks.exe PID 4324 wrote to memory of 3940 4324 RegAsm.exe schtasks.exe PID 4324 wrote to memory of 4308 4324 RegAsm.exe schtasks.exe PID 4324 wrote to memory of 4308 4324 RegAsm.exe schtasks.exe PID 4324 wrote to memory of 4308 4324 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Re Remittance Advice.exe"C:\Users\Admin\AppData\Local\Temp\Re Remittance Advice.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 11 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\Desktop\Bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 113⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\Desktop\Bin.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 21 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Re Remittance Advice.exe" "C:\Users\Admin\Desktop\Bin.exe" && ping 127.0.0.1 -n 21 > nul && "C:\Users\Admin\Desktop\Bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 213⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 213⤵
- Runs ping.exe
-
C:\Users\Admin\Desktop\Bin.exe"C:\Users\Admin\Desktop\Bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA3C.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAD9.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA3C.tmpFilesize
1KB
MD548ef7fa9033389ad7929d7a6b9d10298
SHA19db6cb7325c8bdf66a15f7b5f34703709a45aeb6
SHA2560c1b5f67eeb276d1d4205b138ce32bc6149924e02281a2db8e4623a700e88f15
SHA512ac8bd104ecbacc9bccce9e087f67e5b18072d59367ccd31d4e66132b6baaea520cba5b9b59464483d86abf74826b382c402f12e9a586c99bda8c78a0de33944e
-
C:\Users\Admin\AppData\Local\Temp\tmpAD9.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
C:\Users\Admin\Desktop\Bin.exeFilesize
566KB
MD50f69b38426bbbcb5528aaef9d7d6e054
SHA1bbc0cec1892e41a0d854b33bf8d8f156367caf6b
SHA25624584863e35b36fa2cd4285a6aafd6a117ea0585c5c92ddf289ab13b8af87622
SHA51221bc78a63dc7aa27500261d43747ccf5589a95ebf9a866f7e68bdc8ec89c573a9352e1af438cb8360a29ceee63fb6788841f0f3399159e1f0069bd17abf59df8
-
C:\Users\Admin\Desktop\Bin.exeFilesize
566KB
MD50f69b38426bbbcb5528aaef9d7d6e054
SHA1bbc0cec1892e41a0d854b33bf8d8f156367caf6b
SHA25624584863e35b36fa2cd4285a6aafd6a117ea0585c5c92ddf289ab13b8af87622
SHA51221bc78a63dc7aa27500261d43747ccf5589a95ebf9a866f7e68bdc8ec89c573a9352e1af438cb8360a29ceee63fb6788841f0f3399159e1f0069bd17abf59df8
-
memory/372-146-0x0000000000340000-0x00000000003D4000-memory.dmpFilesize
592KB
-
memory/372-143-0x0000000000000000-mapping.dmp
-
memory/3092-139-0x0000000000000000-mapping.dmp
-
memory/3144-138-0x0000000000000000-mapping.dmp
-
memory/3940-149-0x0000000000000000-mapping.dmp
-
memory/4032-141-0x0000000000000000-mapping.dmp
-
memory/4132-140-0x0000000000000000-mapping.dmp
-
memory/4308-151-0x0000000000000000-mapping.dmp
-
memory/4324-147-0x0000000000000000-mapping.dmp
-
memory/4324-153-0x0000000006AB0000-0x0000000006B16000-memory.dmpFilesize
408KB
-
memory/4324-148-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4564-132-0x00000000002D0000-0x0000000000364000-memory.dmpFilesize
592KB
-
memory/4564-136-0x00000000068B0000-0x00000000068BA000-memory.dmpFilesize
40KB
-
memory/4564-135-0x0000000006800000-0x0000000006892000-memory.dmpFilesize
584KB
-
memory/4564-134-0x0000000006CB0000-0x0000000007254000-memory.dmpFilesize
5.6MB
-
memory/4564-133-0x0000000005990000-0x0000000005A2C000-memory.dmpFilesize
624KB
-
memory/4788-137-0x0000000000000000-mapping.dmp
-
memory/4872-142-0x0000000000000000-mapping.dmp