Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
02/11/2022, 17:16
General
- Target Invoice#57786.exe
- Size 1.1MB
- Sample221102-vs4xtsdacl
- SHA256 6ed9a8b54bcf003ce7c30232c4aec5b6e14dd4722238dd153e8d01a1494eca8f
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
haserhym3.ddns.net:5422
-
91.193.75.132:5422
-
db62c3ca-a1b3-4110-9eba-8a7a8669b20e
-
activate_away_mode
true
-
backup_connection_host
91.193.75.132
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-08-11T05:23:41.456181736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5422
-
default_group
Billionaire
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
db62c3ca-a1b3-4110-9eba-8a7a8669b20e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
haserhym3.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice#57786.exe"C:\Users\Admin\AppData\Local\Temp\Invoice#57786.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\4_109\dpxjvjw.vbe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4_109\fnne.exe"C:\Users\Admin\AppData\Local\Temp\4_109\fnne.exe" mvhijfpmuk.gcu3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ddsonj.xl
fnne.exe
fnne.exe
knhsgx.tvj
mvhijfpmuk.gcu
RegSvcs.exe
RegSvcs.exe
dpxjvjw.vbe
fnne.exe
RegSvcs.exe
memory/740-75-0x0000000000320000-0x0000000000832000-memory.dmp
memory/740-86-0x0000000000C90000-0x0000000000C9C000-memory.dmp
memory/740-93-0x00000000047F0000-0x0000000004804000-memory.dmp
memory/740-69-0x0000000000320000-0x0000000000832000-memory.dmp
memory/740-73-0x0000000000320000-0x0000000000832000-memory.dmp
memory/740-92-0x00000000025E0000-0x000000000260E000-memory.dmp
memory/740-91-0x0000000000FA0000-0x0000000000FAE000-memory.dmp
memory/740-77-0x0000000000320000-0x0000000000358000-memory.dmp
memory/740-79-0x0000000000870000-0x000000000087A000-memory.dmp
memory/740-80-0x0000000000880000-0x000000000089E000-memory.dmp
memory/740-81-0x0000000000900000-0x000000000090A000-memory.dmp
memory/740-82-0x0000000000A20000-0x0000000000A32000-memory.dmp
memory/740-83-0x0000000000B80000-0x0000000000B9A000-memory.dmp
memory/740-84-0x0000000000BA0000-0x0000000000BAE000-memory.dmp
memory/740-85-0x0000000000C00000-0x0000000000C12000-memory.dmp
memory/740-67-0x0000000000320000-0x0000000000832000-memory.dmp
memory/740-87-0x0000000000D50000-0x0000000000D5E000-memory.dmp
memory/740-88-0x0000000000D60000-0x0000000000D74000-memory.dmp
memory/740-89-0x0000000000D70000-0x0000000000D80000-memory.dmp
memory/740-90-0x0000000000DC0000-0x0000000000DD4000-memory.dmp
memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmp