Analysis
-
max time kernel
192s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe
Resource
win7-20220812-en
General
-
Target
53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe
-
Size
1.3MB
-
MD5
6a996f2a5374b0ea2a9d5462be3f54c0
-
SHA1
a7fab0793f6157bae2d1e6a35e084e7ad0e6f82f
-
SHA256
53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7
-
SHA512
e93167fc1d0154077df5a3bd4a975a42da25140dd1a093dac0c61d4685eccb40bc8fc5f42a54b34228be4e26d81370400af67773b3b9de1d7c1ba093ab4e85fe
-
SSDEEP
24576:stb20pknCqT5TBWgNQ7aT1cj4R1fj9nWR936A:VKg5tQ7aTc5
Malware Config
Extracted
nanocore
1.2.2.0
sucepd.no-ip.org:56735
f6d9bf70-995d-4787-a831-24e8bc9f5024
-
activate_away_mode
true
-
backup_connection_host
sucepd.no-ip.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-01-19T16:37:39.409283536Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
56735
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f6d9bf70-995d-4787-a831-24e8bc9f5024
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exedescription pid process target process PID 2828 set thread context of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4840 schtasks.exe 2272 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exeRegSvcs.exepid process 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe 4336 RegSvcs.exe 4336 RegSvcs.exe 4336 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4336 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4336 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exeRegSvcs.exedescription pid process target process PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 2828 wrote to memory of 4336 2828 53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe RegSvcs.exe PID 4336 wrote to memory of 4840 4336 RegSvcs.exe schtasks.exe PID 4336 wrote to memory of 4840 4336 RegSvcs.exe schtasks.exe PID 4336 wrote to memory of 4840 4336 RegSvcs.exe schtasks.exe PID 4336 wrote to memory of 2272 4336 RegSvcs.exe schtasks.exe PID 4336 wrote to memory of 2272 4336 RegSvcs.exe schtasks.exe PID 4336 wrote to memory of 2272 4336 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe"C:\Users\Admin\AppData\Local\Temp\53433e99a690d8d90f4d347bb755e0cb55f7c6ce422ed42a15fe0909ad15e1d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3A88.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3CDB.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3A88.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp3CDB.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
memory/2272-137-0x0000000000000000-mapping.dmp
-
memory/4336-132-0x0000000000000000-mapping.dmp
-
memory/4336-133-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4336-134-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB
-
memory/4336-139-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB
-
memory/4840-135-0x0000000000000000-mapping.dmp