Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2022 07:03
Static task
static1
Behavioral task
behavioral1
Sample
7d12de10e595f4317136eaeccf447629.exe
Resource
win7-20220812-en
General
-
Target
7d12de10e595f4317136eaeccf447629.exe
-
Size
938KB
-
MD5
7d12de10e595f4317136eaeccf447629
-
SHA1
2fcd94c8a01744ef37e997abc292bc6deac00026
-
SHA256
da9ca371e55c5038fb258edd2fda1c788934b7fad232e3b9bd0949fc50a26d92
-
SHA512
87506f2829244927ea159ba245ebe3ec4b61b88a3d4713c9352b8570d8ba36bc6ba4e88228afa95f5013c2f4c0c8031ee942bca977edbe67780d43cbf885e34f
-
SSDEEP
12288:Exbrym2bTZ04mhX7c8u+d2TBLP2bHxApnBL7Uud6Aqy:ExrDY04qrc8u+d8BL0gB9
Malware Config
Extracted
nanocore
1.2.2.0
rolandlandson149.bounceme.net:1007
127.0.0.1:1007
48099ca8-c1b4-49f3-9fe1-d8dfcbf66c09
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-13T20:58:05.824762936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1007
-
default_group
sepTmAn
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
48099ca8-c1b4-49f3-9fe1-d8dfcbf66c09
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
rolandlandson149.bounceme.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" 7d12de10e595f4317136eaeccf447629.exe -
Processes:
7d12de10e595f4317136eaeccf447629.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7d12de10e595f4317136eaeccf447629.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription pid process target process PID 2976 set thread context of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe 7d12de10e595f4317136eaeccf447629.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe 7d12de10e595f4317136eaeccf447629.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3784 schtasks.exe 1512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exepid process 4924 7d12de10e595f4317136eaeccf447629.exe 4924 7d12de10e595f4317136eaeccf447629.exe 4924 7d12de10e595f4317136eaeccf447629.exe 4924 7d12de10e595f4317136eaeccf447629.exe 4924 7d12de10e595f4317136eaeccf447629.exe 4924 7d12de10e595f4317136eaeccf447629.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exepid process 4924 7d12de10e595f4317136eaeccf447629.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exedescription pid process Token: SeDebugPrivilege 4924 7d12de10e595f4317136eaeccf447629.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
7d12de10e595f4317136eaeccf447629.exe7d12de10e595f4317136eaeccf447629.exedescription pid process target process PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 2976 wrote to memory of 4924 2976 7d12de10e595f4317136eaeccf447629.exe 7d12de10e595f4317136eaeccf447629.exe PID 4924 wrote to memory of 3784 4924 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 4924 wrote to memory of 3784 4924 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 4924 wrote to memory of 3784 4924 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 4924 wrote to memory of 1512 4924 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 4924 wrote to memory of 1512 4924 7d12de10e595f4317136eaeccf447629.exe schtasks.exe PID 4924 wrote to memory of 1512 4924 7d12de10e595f4317136eaeccf447629.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"C:\Users\Admin\AppData\Local\Temp\7d12de10e595f4317136eaeccf447629.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp34CB.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3569.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp34CB.tmpFilesize
1KB
MD533100b06e0a3ddf67488894bbb3f2bcb
SHA17c2fac8a173868be0a334dc2d565f10e9e205b93
SHA2566f41974ad5b771367c665f6f54e9f2fe04f2900a68ce32e40e85b3d446d83440
SHA512392540f2c42c39aed6ecd98b4961c53c5232d062119b926fb3354fea6e16d93ae4d92d402099c8e37bd81e77b2c7b6282178f2afbed6987668a3acbef29c9123
-
C:\Users\Admin\AppData\Local\Temp\tmp3569.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
memory/1512-142-0x0000000000000000-mapping.dmp
-
memory/2976-132-0x00000000009B0000-0x0000000000AA0000-memory.dmpFilesize
960KB
-
memory/2976-133-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5.6MB
-
memory/2976-134-0x00000000054A0000-0x0000000005532000-memory.dmpFilesize
584KB
-
memory/2976-135-0x0000000005440000-0x000000000544A000-memory.dmpFilesize
40KB
-
memory/2976-136-0x0000000007B70000-0x0000000007C0C000-memory.dmpFilesize
624KB
-
memory/2976-137-0x0000000007D10000-0x0000000007D76000-memory.dmpFilesize
408KB
-
memory/3784-140-0x0000000000000000-mapping.dmp
-
memory/4924-138-0x0000000000000000-mapping.dmp
-
memory/4924-139-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB