Analysis
-
max time kernel
147s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2022 01:23
Static task
static1
Behavioral task
behavioral1
Sample
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe
Resource
win7-20220812-en
General
-
Target
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe
-
Size
817KB
-
MD5
917304cbf16d908eb2ba957686e24307
-
SHA1
bf1ce405f2b94c02037a7ecd2788c5c0bd41ff18
-
SHA256
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f
-
SHA512
19807893d4298d06717a10ef9d50f589d25d17162299476a1ffd0e146455a3c07fe78d28bfdf5f3b64c4225e9d0e73bfff00f064e8d2bed76eaeff1c718bbdf4
-
SSDEEP
24576:IqYT/0shbH16T/0shbfTMk5hbfFxutmUGAT/4TWjQLL:Hu5uNok51rURT/k
Malware Config
Extracted
nanocore
1.2.2.0
godisgood1.hopto.org:7712
185.225.73.164:7712
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
-
activate_away_mode
true
-
backup_connection_host
185.225.73.164
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-05-24T09:37:49.129028236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7712
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
godisgood1.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FC72BAAF-CA82-4267-85C7-FA730F071451}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{35DFDF00-8446-42EC-8DF4-FD3DF6BF34D0}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription pid process target process PID 2040 set thread context of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Drops file in Program Files directory 2 IoCs
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3752 schtasks.exe 2540 schtasks.exe 4488 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exec84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exepid process 3320 powershell.exe 3320 powershell.exe 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exepid process 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exec84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription pid process Token: SeDebugPrivilege 3320 powershell.exe Token: SeDebugPrivilege 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exec84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exedescription pid process target process PID 2040 wrote to memory of 3320 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe powershell.exe PID 2040 wrote to memory of 3320 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe powershell.exe PID 2040 wrote to memory of 3320 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe powershell.exe PID 2040 wrote to memory of 4488 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 2040 wrote to memory of 4488 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 2040 wrote to memory of 4488 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 2040 wrote to memory of 1496 2040 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe PID 1496 wrote to memory of 3752 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 1496 wrote to memory of 3752 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 1496 wrote to memory of 3752 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 1496 wrote to memory of 2540 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 1496 wrote to memory of 2540 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe PID 1496 wrote to memory of 2540 1496 c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe"C:\Users\Admin\AppData\Local\Temp\c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UaXgSrniDiGTUD.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UaXgSrniDiGTUD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp124B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe"C:\Users\Admin\AppData\Local\Temp\c84ce67e3301da06b2557c15bc368fffa5cf6fe0db842c4662cd2585252cac1f.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp29F9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2A77.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp124B.tmpFilesize
1KB
MD52382355af145cc08a5e668fcdd9e936f
SHA158cae2bafc8b56f183c4dc3a7dee618d2869a892
SHA2567488cb24c39c79321e351dbf6a6fa6addf2620eac5d235e59b959a8d96262777
SHA512a1f79d608c2fa2d80fcefaa8e72a7cd8156c00c3f53ed9b621d541b06609693cf5e570a086f952ba1128909726478eaca38ad59d9704ef9f632b7179a7acbf6e
-
C:\Users\Admin\AppData\Local\Temp\tmp29F9.tmpFilesize
1KB
MD5e100ca7db58579cc3298a6395f6209b6
SHA12dbc199ee412659aaf5cdbdc7d615eb26691b9aa
SHA2567aa7dc527de5ae733efd6e06ebfe08801c383d733280c2cacef1b1acd9901f07
SHA5128c73c07da9c65dc399ae058f3ebc4cc39076c85384ef6a37b5363cc22b3aa2206d414f823f7c77f770b4f2fcb5e2ce1ccaa2310f1eba6a0aaec878d628461177
-
C:\Users\Admin\AppData\Local\Temp\tmp2A77.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
memory/1496-143-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1496-142-0x0000000000000000-mapping.dmp
-
memory/2040-133-0x0000000005BD0000-0x0000000006174000-memory.dmpFilesize
5.6MB
-
memory/2040-134-0x0000000005620000-0x00000000056B2000-memory.dmpFilesize
584KB
-
memory/2040-135-0x00000000055A0000-0x00000000055AA000-memory.dmpFilesize
40KB
-
memory/2040-136-0x0000000007A00000-0x0000000007A9C000-memory.dmpFilesize
624KB
-
memory/2040-132-0x0000000000B10000-0x0000000000BE2000-memory.dmpFilesize
840KB
-
memory/2540-149-0x0000000000000000-mapping.dmp
-
memory/3320-146-0x0000000005BC0000-0x0000000005C26000-memory.dmpFilesize
408KB
-
memory/3320-152-0x0000000006740000-0x0000000006772000-memory.dmpFilesize
200KB
-
memory/3320-145-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/3320-141-0x0000000005370000-0x0000000005998000-memory.dmpFilesize
6.2MB
-
memory/3320-161-0x0000000007820000-0x0000000007828000-memory.dmpFilesize
32KB
-
memory/3320-139-0x0000000002850000-0x0000000002886000-memory.dmpFilesize
216KB
-
memory/3320-160-0x0000000007830000-0x000000000784A000-memory.dmpFilesize
104KB
-
memory/3320-137-0x0000000000000000-mapping.dmp
-
memory/3320-151-0x00000000061F0000-0x000000000620E000-memory.dmpFilesize
120KB
-
memory/3320-144-0x00000000050A0000-0x00000000050C2000-memory.dmpFilesize
136KB
-
memory/3320-153-0x00000000701E0000-0x000000007022C000-memory.dmpFilesize
304KB
-
memory/3320-154-0x0000000006720000-0x000000000673E000-memory.dmpFilesize
120KB
-
memory/3320-155-0x0000000007AF0000-0x000000000816A000-memory.dmpFilesize
6.5MB
-
memory/3320-156-0x0000000007470000-0x000000000748A000-memory.dmpFilesize
104KB
-
memory/3320-157-0x00000000074E0000-0x00000000074EA000-memory.dmpFilesize
40KB
-
memory/3320-158-0x0000000007710000-0x00000000077A6000-memory.dmpFilesize
600KB
-
memory/3320-159-0x00000000076B0000-0x00000000076BE000-memory.dmpFilesize
56KB
-
memory/3752-147-0x0000000000000000-mapping.dmp
-
memory/4488-138-0x0000000000000000-mapping.dmp