Analysis
-
max time kernel
105s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2022 09:22
Static task
static1
Behavioral task
behavioral1
Sample
MDB.exe
Resource
win7-20220812-en
General
-
Target
MDB.exe
-
Size
860KB
-
MD5
d84b1332e0fecd92b90b321f1f4a784a
-
SHA1
5b6c2a0251ad7a5bbbf51d0ff300f8c29969693a
-
SHA256
4f0a3115465d03a83773bec157884cbbf36858924e68115302f540d0ad02ee53
-
SHA512
ce0e1e14ca9e6664e3022e40e5f9cafaad7b8deda933223855f619b189121411132864bec7e1a80818d65f62d053ca2f627a8d474c25385aa0f400fc31298444
-
SSDEEP
12288:g91R6PxJfTADqjJ5n0U9C1DtGbQkc36b4Bao8pPTtcQMmWmeZA2:gefrjr0U85AbC3RGfcQnd
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MDB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation MDB.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MDB.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Monitor = "C:\\Program Files (x86)\\AGP Monitor\\agpmon.exe" MDB.exe -
Processes:
MDB.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MDB.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MDB.exedescription pid process target process PID 636 set thread context of 3588 636 MDB.exe MDB.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MDB.exedescription ioc process File created C:\Program Files (x86)\AGP Monitor\agpmon.exe MDB.exe File opened for modification C:\Program Files (x86)\AGP Monitor\agpmon.exe MDB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1248 schtasks.exe 1540 schtasks.exe 1748 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
MDB.exepid process 3588 MDB.exe 3588 MDB.exe 3588 MDB.exe 3588 MDB.exe 3588 MDB.exe 3588 MDB.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MDB.exepid process 3588 MDB.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MDB.exedescription pid process Token: SeDebugPrivilege 3588 MDB.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
MDB.exeMDB.exedescription pid process target process PID 636 wrote to memory of 1248 636 MDB.exe schtasks.exe PID 636 wrote to memory of 1248 636 MDB.exe schtasks.exe PID 636 wrote to memory of 1248 636 MDB.exe schtasks.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 636 wrote to memory of 3588 636 MDB.exe MDB.exe PID 3588 wrote to memory of 1540 3588 MDB.exe schtasks.exe PID 3588 wrote to memory of 1540 3588 MDB.exe schtasks.exe PID 3588 wrote to memory of 1540 3588 MDB.exe schtasks.exe PID 3588 wrote to memory of 1748 3588 MDB.exe schtasks.exe PID 3588 wrote to memory of 1748 3588 MDB.exe schtasks.exe PID 3588 wrote to memory of 1748 3588 MDB.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MDB.exe"C:\Users\Admin\AppData\Local\Temp\MDB.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SATancQW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDDC2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\MDB.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE1BA.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE228.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MDB.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\Temp\tmpDDC2.tmpFilesize
1KB
MD53611d3ce89c593a73a45882239373796
SHA1802541d1967c74fa3a93e10178a21a959b96ac36
SHA2569c68fb7bef74b3739822ad69680312dbe8e1723214f2b7f09fd47d30539adc96
SHA51264bb27be9a292a7eba58dd1f936ae9bb349e8d07e9ff612597871dabd8caf320fd4009116d4a191f847971da9a34f5bbf10055d5493b6826aec03461917039d5
-
C:\Users\Admin\AppData\Local\Temp\tmpE1BA.tmpFilesize
1KB
MD5671c79cd978749f6b39fc08dbff8a77d
SHA1e05b2370ae4ba264f2f7e2cdf75450435b211e20
SHA2562011c9c1d2a4445b7a9fc98d3dfce9f0dd48ce3b8ec1242b96e6fbf7ac65fb5b
SHA51270dfca3506412b2f26e05dae58b86c86d67ee46551313a2066450fef489943e884ae28334f92f79d06a840b3ca240d9f09439347f44ca9ccd8aad7f572cbc53d
-
C:\Users\Admin\AppData\Local\Temp\tmpE228.tmpFilesize
1KB
MD5157cd55403665c49c9fd3ca1196c4397
SHA14feed6e606b41bb617274471349582963182756b
SHA25649d903f84313feb16bd189c58b6c206f98b05da00ea0da881e2ff0c893b6ba5e
SHA512bea7e3caa9c37cadd772a6d3ee0d9ed47de6b3e880cd58649be2939cacd00f70d4edc1ad177e432539267bb520094d9cda3f781cdfc69122f3775242321c11b8
-
memory/636-133-0x0000000005680000-0x0000000005C24000-memory.dmpFilesize
5.6MB
-
memory/636-135-0x0000000005210000-0x00000000052AC000-memory.dmpFilesize
624KB
-
memory/636-136-0x0000000005110000-0x000000000511A000-memory.dmpFilesize
40KB
-
memory/636-134-0x0000000005170000-0x0000000005202000-memory.dmpFilesize
584KB
-
memory/636-132-0x0000000000680000-0x000000000075E000-memory.dmpFilesize
888KB
-
memory/1248-137-0x0000000000000000-mapping.dmp
-
memory/1540-142-0x0000000000000000-mapping.dmp
-
memory/1748-144-0x0000000000000000-mapping.dmp
-
memory/3588-140-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3588-139-0x0000000000000000-mapping.dmp
-
memory/3588-146-0x0000000006AF0000-0x0000000006B56000-memory.dmpFilesize
408KB