Analysis
-
max time kernel
170s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 22:02
Behavioral task
behavioral1
Sample
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe
Resource
win7-20220812-en
General
-
Target
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe
-
Size
1.7MB
-
MD5
6d1968a29a85d8da0aba07325a112470
-
SHA1
8c33dd887ee77217bbe45cac603af501884eac06
-
SHA256
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f
-
SHA512
71e3c16b1eaf63953732abf19f90826c730b22bcf283889843628cfe1218268c1ad714ef71005c32e03fc8921b9bcced5e670d330df62ef9c0868b05d48c4f96
-
SSDEEP
24576:xthEVaPqLB/OXA8faoMTRpyiLthEVaPqLB/OXA8faoMTRpyiZ:pEVUcwkB3VfEVUcwkB3VZ
Malware Config
Extracted
nanocore
1.2.2.0
lolli.no-ip.info:1133
e230b6f6-7d07-46a4-ae63-b23db679b6b4
-
activate_away_mode
true
-
backup_connection_host
lolli.no-ip.info
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-02-05T19:59:01.018438736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1133
-
default_group
extreme v2 tut
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
e230b6f6-7d07-46a4-ae63-b23db679b6b4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lolli.no-ip.info
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
net.exepid process 3892 net.exe -
Processes:
resource yara_rule behavioral2/memory/1128-132-0x0000000000400000-0x0000000000516000-memory.dmp upx behavioral2/memory/1128-133-0x0000000000400000-0x0000000000516000-memory.dmp upx behavioral2/memory/1128-135-0x0000000000400000-0x0000000000516000-memory.dmp upx behavioral2/memory/4200-137-0x0000000000400000-0x0000000000516000-memory.dmp upx behavioral2/memory/228-139-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral2/memory/4200-141-0x0000000000400000-0x0000000000516000-memory.dmp upx behavioral2/memory/228-142-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral2/memory/228-143-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral2/memory/228-146-0x0000000000400000-0x00000000004D1000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\image.png upx behavioral2/memory/228-152-0x0000000000400000-0x00000000004D1000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
svchost.exenet.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\ProgramData\\SoundDriver\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" net.exe -
Processes:
net.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA net.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1128-133-0x0000000000400000-0x0000000000516000-memory.dmp autoit_exe behavioral2/memory/1128-135-0x0000000000400000-0x0000000000516000-memory.dmp autoit_exe behavioral2/memory/4200-137-0x0000000000400000-0x0000000000516000-memory.dmp autoit_exe behavioral2/memory/4200-141-0x0000000000400000-0x0000000000516000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exesvchost.exedescription pid process target process PID 4200 set thread context of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 228 set thread context of 3892 228 svchost.exe net.exe -
Drops file in Program Files directory 2 IoCs
Processes:
net.exedescription ioc process File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe net.exe File created C:\Program Files (x86)\DDP Host\ddphost.exe net.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1412 schtasks.exe 5060 schtasks.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exesvchost.exenet.exepid process 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 228 svchost.exe 228 svchost.exe 228 svchost.exe 228 svchost.exe 3892 net.exe 3892 net.exe 3892 net.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
net.exepid process 3892 net.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
net.exedescription pid process Token: SeDebugPrivilege 3892 net.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exepid process 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exepid process 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 228 svchost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exesvchost.exenet.exedescription pid process target process PID 1128 wrote to memory of 4200 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe PID 1128 wrote to memory of 4200 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe PID 1128 wrote to memory of 4200 1128 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 4200 wrote to memory of 228 4200 01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe svchost.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 228 wrote to memory of 3892 228 svchost.exe net.exe PID 3892 wrote to memory of 1412 3892 net.exe schtasks.exe PID 3892 wrote to memory of 1412 3892 net.exe schtasks.exe PID 3892 wrote to memory of 1412 3892 net.exe schtasks.exe PID 3892 wrote to memory of 5060 3892 net.exe schtasks.exe PID 3892 wrote to memory of 5060 3892 net.exe schtasks.exe PID 3892 wrote to memory of 5060 3892 net.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe"C:\Users\Admin\AppData\Local\Temp\01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exeC:\Users\Admin\AppData\Local\Temp\01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\test.a3x"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\svchost.exe"c:\windows\system32\svchost.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\net.exe"C:\Users\Admin\AppData\Local\Temp\net.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFF8E.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp26BE.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\image.pngFilesize
1.7MB
MD56d1968a29a85d8da0aba07325a112470
SHA18c33dd887ee77217bbe45cac603af501884eac06
SHA25601ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f
SHA51271e3c16b1eaf63953732abf19f90826c730b22bcf283889843628cfe1218268c1ad714ef71005c32e03fc8921b9bcced5e670d330df62ef9c0868b05d48c4f96
-
C:\Users\Admin\AppData\Local\Temp\net.exeFilesize
4KB
MD5840a36331c4f297e44a44a689b764a38
SHA14fa1de1a22325e9a906ea5427af1aeb93b1e568a
SHA2560cb1fcb8cfed3c33dd9374c7109d39e78ce562597897bcde749d8fdc7c935b77
SHA512790b9e5d284c5e1c3ade1800c8e2d59c7a71baf47949e03d66136ab7c0abfd6fe32c186eda9cc025afd7e45ecf5b85103599fe6b2995783d51fc31bca03f0be0
-
C:\Users\Admin\AppData\Local\Temp\net.exeFilesize
4KB
MD5840a36331c4f297e44a44a689b764a38
SHA14fa1de1a22325e9a906ea5427af1aeb93b1e568a
SHA2560cb1fcb8cfed3c33dd9374c7109d39e78ce562597897bcde749d8fdc7c935b77
SHA512790b9e5d284c5e1c3ade1800c8e2d59c7a71baf47949e03d66136ab7c0abfd6fe32c186eda9cc025afd7e45ecf5b85103599fe6b2995783d51fc31bca03f0be0
-
C:\Users\Admin\AppData\Local\Temp\test.a3xFilesize
397KB
MD54e4cddd13c848074c11d4f1d291c6aba
SHA153e0002cead55ba20ef6261b1a43967e612fb558
SHA2564070ad29af1c0328ceec6b7032f2ff7fa94ee4adaead367f32c549d13ebbcf77
SHA512261bca93ac6b50af8c96b22d74b5a740380516869b3773c5f162924e8825770ebf6b65da83ac578cb592cfe9997bee8433e55648d32c2f2da83297904fbebb76
-
C:\Users\Admin\AppData\Local\Temp\tmp26BE.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
memory/228-143-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/228-139-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/228-142-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/228-146-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/228-152-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/228-138-0x0000000000000000-mapping.dmp
-
memory/1128-135-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/1128-133-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/1128-132-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/1412-155-0x0000000000000000-mapping.dmp
-
memory/3892-148-0x0000000000000000-mapping.dmp
-
memory/3892-149-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3892-153-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/3892-154-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4200-134-0x0000000000000000-mapping.dmp
-
memory/4200-137-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/4200-141-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/5060-156-0x0000000000000000-mapping.dmp