Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2022 05:45
Static task
static1
General
-
Target
3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe
-
Size
180KB
-
MD5
d68c1898ceffa72ba1ac579c83cc494c
-
SHA1
0cbea644e19ae6d3b934a648b5bd1a9558c64e96
-
SHA256
3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc
-
SHA512
35b09232dd1abb7d23910e64d09e6bebd43bc2469c6e4d44a2a4ed8fd88051ec0d08206a8fce25f1efb5aa85cefb9a8d87ddf9adb026029894c5481a19bb1b43
-
SSDEEP
1536:0GBVDgKMoum8X/ScqsClbZ5hapDbEJ0XIPnG+aaMrIl0PegZoZZZZZZZZZZZZZgJ:0muRjClb81C5adRQQelxyAx9fCTt
Malware Config
Extracted
Family |
nanocore |
Version |
1.2.2.0 |
C2 |
95.70.139.81:54984 |
Attributes |
activate_away_mode false
backup_connection_host 95.70.139.81
backup_dns_server 8.8.4.4
buffer_size 65535
build_time 2022-07-01T08:20:47.457547136Z
bypass_user_account_control true
bypass_user_account_control_data
clear_access_control false
clear_zone_identifier false
connect_delay 4000
connection_port 54984
default_group Default
enable_debug_mode true
gc_threshold 1.048576e+07
keep_alive_timeout 30000
keyboard_logging false
lan_timeout 2500
max_packet_size 1.048576e+07
mutex 2afd92d3-82ee-48f4-9de3-98029fbb1ca4
mutex_timeout 5000
prevent_system_sleep false
primary_connection_host 95.70.139.81
primary_dns_server 8.8.8.8
request_elevation false
restart_delay 5000
run_delay 0
run_on_startup false
set_critical_process false
timeout_interval 5000
use_custom_dns_server false
version 1.2.2.0
wan_timeout 8000 |
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE ⋅ 2 IoCs
Processes:
IAppIdAuthority.exeIAppIdAuthority.exepid process 4112 IAppIdAuthority.exe 708 IAppIdAuthority.exe -
Adds Run key to start application ⋅ 2 TTPs 1 IoCs
Processes:
IAppIdAuthority.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" IAppIdAuthority.exe -
Processes:
IAppIdAuthority.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IAppIdAuthority.exe -
Suspicious use of SetThreadContext ⋅ 2 IoCs
Processes:
3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exeIAppIdAuthority.exedescription pid process target process PID 2764 set thread context of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 4112 set thread context of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe -
Drops file in Program Files directory ⋅ 2 IoCs
Processes:
IAppIdAuthority.exedescription ioc process File created C:\Program Files (x86)\UDP Subsystem\udpss.exe IAppIdAuthority.exe File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe IAppIdAuthority.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
Processes:
IAppIdAuthority.exepid process 708 IAppIdAuthority.exe 708 IAppIdAuthority.exe 708 IAppIdAuthority.exe -
Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
Processes:
IAppIdAuthority.exepid process 708 IAppIdAuthority.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 4 IoCs
Processes:
3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exeIAppIdAuthority.exeIAppIdAuthority.exedescription pid process Token: SeDebugPrivilege 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe Token: SeDebugPrivilege 4112 IAppIdAuthority.exe Token: SeDebugPrivilege 708 IAppIdAuthority.exe Token: SeDebugPrivilege 708 IAppIdAuthority.exe -
Suspicious use of WriteProcessMemory ⋅ 19 IoCs
Processes:
3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exeIAppIdAuthority.exedescription pid process target process PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4236 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe PID 2764 wrote to memory of 4112 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe IAppIdAuthority.exe PID 2764 wrote to memory of 4112 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe IAppIdAuthority.exe PID 2764 wrote to memory of 4112 2764 3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe PID 4112 wrote to memory of 708 4112 IAppIdAuthority.exe IAppIdAuthority.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe"C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe"Suspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe"C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe"
-
C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exeC:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exeExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe"C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe"Executes dropped EXEAdds Run key to start applicationChecks whether UAC is enabledDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious behavior: GetForegroundWindowSpamSuspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe.logMD5
1254c55dd47bb823e0ce10dff0298a20
SHA1de1c780a4c75090053003f4eb606fe481f6126aa
SHA25616f124d47c9cda13c9ead5a1061eda573201b16ca09b66ea2d30d41c3ab1f562
SHA51296d562b16ed0436a2aa45d5ee83af82f0be34f2d1d48a21cefe57bc1b95a4d788c19a59cf7d8eacfe6e01f88c918675591c1e2e05782c659918562b77fc3eb6e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IAppIdAuthority.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exeMD5
9c44d904890df75e5f1b7c3c3ba0b7db
SHA12aea8311e7e1178396d5308d3853b6dc0334f849
SHA256e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d
SHA512bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788
-
C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exeMD5
9c44d904890df75e5f1b7c3c3ba0b7db
SHA12aea8311e7e1178396d5308d3853b6dc0334f849
SHA256e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d
SHA512bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788
-
C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exeMD5
9c44d904890df75e5f1b7c3c3ba0b7db
SHA12aea8311e7e1178396d5308d3853b6dc0334f849
SHA256e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d
SHA512bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788
-
memory/708-302-0x000000000041E792-mapping.dmp
-
memory/708-369-0x00000000050D0000-0x00000000050DA000-memory.dmp
-
memory/708-367-0x00000000050B0000-0x00000000050CE000-memory.dmp
-
memory/708-366-0x0000000004BB0000-0x0000000004BBA000-memory.dmp
-
memory/708-340-0x0000000000600000-0x0000000000638000-memory.dmp
-
memory/2764-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-149-0x0000000000560000-0x0000000000594000-memory.dmp
-
memory/2764-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-153-0x0000000004D90000-0x0000000004E2C000-memory.dmp
-
memory/2764-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-185-0x0000000004D80000-0x0000000004D92000-memory.dmp
-
memory/2764-191-0x0000000005B40000-0x000000000603E000-memory.dmp
-
memory/2764-219-0x0000000005750000-0x00000000057E2000-memory.dmp
-
memory/2764-228-0x0000000005720000-0x000000000572A000-memory.dmp
-
memory/2764-116-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-117-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/2764-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp
-
memory/4112-276-0x00000000000E0000-0x0000000000160000-memory.dmp
-
memory/4112-239-0x0000000000000000-mapping.dmp
-
memory/4112-299-0x00000000049C0000-0x00000000049D0000-memory.dmp
-
memory/4236-187-0x0000000000402EEE-mapping.dmp
-
memory/4236-222-0x0000000000400000-0x0000000000408000-memory.dmp