Analysis
-
max time kernel
75s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-09-2022 05:46
Static task
static1
Behavioral task
behavioral1
Sample
remittance.exe
Resource
win7-20220812-en
General
-
Target
remittance.exe
-
Size
1.0MB
-
MD5
31c5c19e5cbf0993baeef892e8f73ada
-
SHA1
3f39dd3802f34e7f0b8d307a5aa31daac779c3c8
-
SHA256
b9b9fa184afcfe0808c76a42a44a22e960d0283cf763c120be371122d0de8174
-
SHA512
083b584a585fc100ee3619ad31042d0b9188e2bf81ec3f178fb2e89a2854af30d57adef2e59e46e48f0a6abfd951706d5dee52d9479f4c12317dd0fdf2e4fe86
-
SSDEEP
12288:BGVMmLXxPgZ8Uqcozk9h5uRsOLNoJ86aA/qoUmdaee/QCaCNqGVM9d4dIw8:B1mRgZjqco49hKssoJ8tydLC/VIdkIt
Malware Config
Extracted
nanocore
1.2.2.0
brightnano1.ddns.net:1989
171.22.30.97:1989
fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe
-
activate_away_mode
true
-
backup_connection_host
171.22.30.97
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-10T14:34:05.030247036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1989
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
brightnano1.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
remittance.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" remittance.exe -
Processes:
remittance.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA remittance.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
remittance.exedescription pid process target process PID 536 set thread context of 1228 536 remittance.exe remittance.exe -
Drops file in Program Files directory 2 IoCs
Processes:
remittance.exedescription ioc process File created C:\Program Files (x86)\SCSI Service\scsisvc.exe remittance.exe File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe remittance.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 956 schtasks.exe 1892 schtasks.exe 316 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
remittance.exepid process 1228 remittance.exe 1228 remittance.exe 1228 remittance.exe 1228 remittance.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
remittance.exepid process 1228 remittance.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
remittance.exedescription pid process Token: SeDebugPrivilege 1228 remittance.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
remittance.exeremittance.exedescription pid process target process PID 536 wrote to memory of 956 536 remittance.exe schtasks.exe PID 536 wrote to memory of 956 536 remittance.exe schtasks.exe PID 536 wrote to memory of 956 536 remittance.exe schtasks.exe PID 536 wrote to memory of 956 536 remittance.exe schtasks.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 536 wrote to memory of 1228 536 remittance.exe remittance.exe PID 1228 wrote to memory of 1892 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 1892 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 1892 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 1892 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 316 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 316 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 316 1228 remittance.exe schtasks.exe PID 1228 wrote to memory of 316 1228 remittance.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\remittance.exe"C:\Users\Admin\AppData\Local\Temp\remittance.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QgSBwlYTdt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp562C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\remittance.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5B89.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5C74.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp562C.tmpFilesize
1KB
MD529a50b56474a855d5afd4ac345c462b7
SHA159a0c906067e7668cb4c4946a9149ac73c936ece
SHA2560f0a0897773d7150d3e8148c4ba1a76b3fa8ef44dc5dd3e606d1966ceaf75f21
SHA5120260bbcb06b52167f316469b1f2d73d4011a07c838ce99d4cb3ac683f5a0397edc50a177f83679b843258ad1558a0caf749631a5fb637cd9100e86f52bb1ba28
-
C:\Users\Admin\AppData\Local\Temp\tmp5B89.tmpFilesize
1KB
MD55b40c05ffe47a1227d3db2c56517ecfe
SHA11ea3f663140e2e90ec188487d5e18b038d193f74
SHA256a99d30fe31f4a0b49cf83dd407130c99a8b54d8637efcedcac84a4ff2b19953f
SHA5123a641ceb180611a778ada9403bb5e8edab66efee93851ee95033013571a43f2f13b5e3b140d1812128d8203052e4a8c603603a91c3b7c73edd62dc246e55691c
-
C:\Users\Admin\AppData\Local\Temp\tmp5C74.tmpFilesize
1KB
MD54e71faa3a77029484cfaba423d96618f
SHA19c837d050bb43d69dc608af809c292e13bca4718
SHA256c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb
SHA5126d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0
-
memory/316-76-0x0000000000000000-mapping.dmp
-
memory/536-55-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/536-56-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/536-57-0x00000000053D0000-0x000000000545C000-memory.dmpFilesize
560KB
-
memory/536-58-0x0000000000970000-0x00000000009AA000-memory.dmpFilesize
232KB
-
memory/536-54-0x00000000009C0000-0x0000000000ACA000-memory.dmpFilesize
1.0MB
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/1228-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-80-0x0000000000660000-0x000000000066A000-memory.dmpFilesize
40KB
-
memory/1228-68-0x000000000041E792-mapping.dmp
-
memory/1228-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-92-0x0000000004700000-0x0000000004714000-memory.dmpFilesize
80KB
-
memory/1228-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-78-0x0000000000550000-0x000000000055A000-memory.dmpFilesize
40KB
-
memory/1228-79-0x0000000000560000-0x000000000057E000-memory.dmpFilesize
120KB
-
memory/1228-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1228-81-0x0000000000870000-0x0000000000882000-memory.dmpFilesize
72KB
-
memory/1228-82-0x0000000000880000-0x000000000089A000-memory.dmpFilesize
104KB
-
memory/1228-83-0x00000000008F0000-0x00000000008FE000-memory.dmpFilesize
56KB
-
memory/1228-84-0x0000000000910000-0x0000000000922000-memory.dmpFilesize
72KB
-
memory/1228-85-0x0000000000920000-0x000000000092E000-memory.dmpFilesize
56KB
-
memory/1228-86-0x00000000009B0000-0x00000000009BC000-memory.dmpFilesize
48KB
-
memory/1228-87-0x0000000002060000-0x0000000002074000-memory.dmpFilesize
80KB
-
memory/1228-88-0x00000000020B0000-0x00000000020C0000-memory.dmpFilesize
64KB
-
memory/1228-89-0x0000000002200000-0x0000000002214000-memory.dmpFilesize
80KB
-
memory/1228-90-0x0000000002210000-0x000000000221E000-memory.dmpFilesize
56KB
-
memory/1228-91-0x0000000004750000-0x000000000477E000-memory.dmpFilesize
184KB
-
memory/1892-74-0x0000000000000000-mapping.dmp