Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-09-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
outstanding statement.exe
Resource
win7-20220812-en
General
-
Target
outstanding statement.exe
-
Size
747KB
-
MD5
c83f7860b0c0f1ad76d8ca65c6bad689
-
SHA1
221ba6cf88de4c688583c69e8892ec9c3804a11e
-
SHA256
94bcc238e29903cc49036da98144dae0c7e10526669d6c50e3b87239f8e27262
-
SHA512
b0d67dc5e4f1bfdefd3785c33088823fabf690107b58b9efa88c617fe2c1f679b651e7826187106b5f8f4e5b44d4b92ff7d3b9e247a908e1ddc6591fb00c8307
-
SSDEEP
12288:PHK2xwKKFbHecmpYAf6GZPVNzBKUcY4oqwlsLhARylQ:/KvHBu1iizgUcGqwlsL+E
Malware Config
Extracted
nanocore
1.2.2.0
dera5nano.ddns.net:1010
107.182.129.248:1010
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
activate_away_mode
true
-
backup_connection_host
107.182.129.248
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-06T12:07:01.612898436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1010
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dera5nano.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
outstanding statement.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" outstanding statement.exe -
Processes:
outstanding statement.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA outstanding statement.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
outstanding statement.exedescription pid process target process PID 2020 set thread context of 952 2020 outstanding statement.exe outstanding statement.exe -
Drops file in Program Files directory 2 IoCs
Processes:
outstanding statement.exedescription ioc process File created C:\Program Files (x86)\UDP Service\udpsv.exe outstanding statement.exe File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe outstanding statement.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1680 schtasks.exe 1880 schtasks.exe 856 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
outstanding statement.exepid process 952 outstanding statement.exe 952 outstanding statement.exe 952 outstanding statement.exe 952 outstanding statement.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
outstanding statement.exepid process 952 outstanding statement.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
outstanding statement.exedescription pid process Token: SeDebugPrivilege 952 outstanding statement.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
outstanding statement.exeoutstanding statement.exedescription pid process target process PID 2020 wrote to memory of 1680 2020 outstanding statement.exe schtasks.exe PID 2020 wrote to memory of 1680 2020 outstanding statement.exe schtasks.exe PID 2020 wrote to memory of 1680 2020 outstanding statement.exe schtasks.exe PID 2020 wrote to memory of 1680 2020 outstanding statement.exe schtasks.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 2020 wrote to memory of 952 2020 outstanding statement.exe outstanding statement.exe PID 952 wrote to memory of 1880 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 1880 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 1880 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 1880 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 856 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 856 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 856 952 outstanding statement.exe schtasks.exe PID 952 wrote to memory of 856 952 outstanding statement.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\outstanding statement.exe"C:\Users\Admin\AppData\Local\Temp\outstanding statement.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OIdzpXTWJYUnz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB70.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\outstanding statement.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp224.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2EF.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp224.tmpFilesize
1KB
MD5c5d2ba6a2aad8ee1b0d7bf205a163cef
SHA1d4cf13be2e945f96a95db32e60d3661cc0d00c47
SHA256341917cad8660741290b81b12eb2aa21e05bd53f1e7411329d254c8b405fa937
SHA51205f0aa3671a166a5e7b2be436131fbf07ddb6c4e6933e8763c13779e7c398aaeefd208ef9c48db50b34b62d1f88ab8f8e346a52f3dcf760b7751f5b88e37a949
-
C:\Users\Admin\AppData\Local\Temp\tmp2EF.tmpFilesize
1KB
MD50a24db62cb5b84309c4803346caaa25d
SHA167660778f61bb44168c33ed3fe56ed86cf9583e8
SHA25638d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
-
C:\Users\Admin\AppData\Local\Temp\tmpFB70.tmpFilesize
1KB
MD5194e4e26394715bf7f26a75be630d139
SHA12756b8e4c4f2e94d7028313785106a34c2920da6
SHA2563295c6df29596f017407c06dc7dd4ad69891b9aff781c728ea79c44b371a270e
SHA512f0f525cbb2fd970a0a79a9b8a3698b3b5310ee8ba81b7c3c65a364dd7982d2fb236481794b94f60d3d75f845641c4fedbd3910a4751b4bbaec832e8e1fa0addf
-
memory/856-76-0x0000000000000000-mapping.dmp
-
memory/952-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-78-0x00000000003B0000-0x00000000003BA000-memory.dmpFilesize
40KB
-
memory/952-92-0x0000000000BE0000-0x0000000000BF4000-memory.dmpFilesize
80KB
-
memory/952-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-91-0x0000000000C70000-0x0000000000C9E000-memory.dmpFilesize
184KB
-
memory/952-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-68-0x000000000041E792-mapping.dmp
-
memory/952-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/952-90-0x0000000000B40000-0x0000000000B4E000-memory.dmpFilesize
56KB
-
memory/952-89-0x0000000000B30000-0x0000000000B44000-memory.dmpFilesize
80KB
-
memory/952-88-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/952-87-0x0000000000A60000-0x0000000000A74000-memory.dmpFilesize
80KB
-
memory/952-86-0x0000000000A50000-0x0000000000A5C000-memory.dmpFilesize
48KB
-
memory/952-79-0x00000000003D0000-0x00000000003EE000-memory.dmpFilesize
120KB
-
memory/952-80-0x00000000003C0000-0x00000000003CA000-memory.dmpFilesize
40KB
-
memory/952-81-0x00000000005E0000-0x00000000005F2000-memory.dmpFilesize
72KB
-
memory/952-82-0x00000000005F0000-0x000000000060A000-memory.dmpFilesize
104KB
-
memory/952-83-0x0000000000870000-0x000000000087E000-memory.dmpFilesize
56KB
-
memory/952-84-0x0000000000A30000-0x0000000000A42000-memory.dmpFilesize
72KB
-
memory/952-85-0x0000000000A40000-0x0000000000A4E000-memory.dmpFilesize
56KB
-
memory/1680-59-0x0000000000000000-mapping.dmp
-
memory/1880-74-0x0000000000000000-mapping.dmp
-
memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/2020-56-0x0000000000420000-0x0000000000440000-memory.dmpFilesize
128KB
-
memory/2020-57-0x0000000005D80000-0x0000000005E0A000-memory.dmpFilesize
552KB
-
memory/2020-54-0x0000000000F10000-0x0000000000FD0000-memory.dmpFilesize
768KB
-
memory/2020-58-0x0000000000A10000-0x0000000000A4A000-memory.dmpFilesize
232KB