Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 06:00
Static task
static1
Behavioral task
behavioral1
Sample
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe
Resource
win7-20220901-en
General
-
Target
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe
-
Size
157KB
-
MD5
d53551cb26943da86f5da83b7d2bc6c3
-
SHA1
e603501738f06eea175d188c8e6f047123ab9a0d
-
SHA256
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d
-
SHA512
21d71d2e50060106d2a07b60e6f0be9fc689994edc8999c494928cab22b6a4904a3c52200bbf17d898c39f09728602d7e7e3fd835f70a1e65b9a29bc712c8b46
-
SSDEEP
3072:xRq+GCq4ErVS8nN6AljpG4F/9flzEAx+acq33lOig6t7iOvAj2Ia2/SvNr:Pq+G5/E8nNlw4F/4oHj2S
Malware Config
Extracted
nanocore
1.2.2.0
joesrat.no-ip.biz:9005
127.0.0.1:9005
7f71b0b5-f5de-496e-9a9a-1c680f93f6af
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
- backup_dns_server
-
buffer_size
65535
-
build_time
2015-01-12T18:59:00.843678836Z
-
bypass_user_account_control
true
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9005
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
7f71b0b5-f5de-496e-9a9a-1c680f93f6af
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
joesrat.no-ip.biz
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
core.exepid process 1668 core.exe -
Loads dropped DLL 2 IoCs
Processes:
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exepid process 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe -
Processes:
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exedescription pid process target process PID 1604 set thread context of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.execore.exepid process 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe 1668 core.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.execore.exedescription pid process Token: SeDebugPrivilege 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe Token: SeDebugPrivilege 1668 core.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exedescription pid process target process PID 1604 wrote to memory of 1944 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 1944 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 1944 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 1944 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 656 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 656 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 656 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 656 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 756 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe PID 1604 wrote to memory of 1668 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe core.exe PID 1604 wrote to memory of 1668 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe core.exe PID 1604 wrote to memory of 1668 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe core.exe PID 1604 wrote to memory of 1668 1604 8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe core.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe"2⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\core.exe"C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 756 C:\Users\Admin\AppData\Local\Temp\8ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\core.exeFilesize
157KB
MD5d53551cb26943da86f5da83b7d2bc6c3
SHA1e603501738f06eea175d188c8e6f047123ab9a0d
SHA2568ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d
SHA51221d71d2e50060106d2a07b60e6f0be9fc689994edc8999c494928cab22b6a4904a3c52200bbf17d898c39f09728602d7e7e3fd835f70a1e65b9a29bc712c8b46
-
C:\Users\Admin\AppData\Local\Temp\core.exeFilesize
157KB
MD5d53551cb26943da86f5da83b7d2bc6c3
SHA1e603501738f06eea175d188c8e6f047123ab9a0d
SHA2568ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d
SHA51221d71d2e50060106d2a07b60e6f0be9fc689994edc8999c494928cab22b6a4904a3c52200bbf17d898c39f09728602d7e7e3fd835f70a1e65b9a29bc712c8b46
-
\Users\Admin\AppData\Local\Temp\core.exeFilesize
157KB
MD5d53551cb26943da86f5da83b7d2bc6c3
SHA1e603501738f06eea175d188c8e6f047123ab9a0d
SHA2568ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d
SHA51221d71d2e50060106d2a07b60e6f0be9fc689994edc8999c494928cab22b6a4904a3c52200bbf17d898c39f09728602d7e7e3fd835f70a1e65b9a29bc712c8b46
-
\Users\Admin\AppData\Local\Temp\core.exeFilesize
157KB
MD5d53551cb26943da86f5da83b7d2bc6c3
SHA1e603501738f06eea175d188c8e6f047123ab9a0d
SHA2568ad0452c00c11675e9601fb3183144c79192c79db9a78627ef862869bbfcca1d
SHA51221d71d2e50060106d2a07b60e6f0be9fc689994edc8999c494928cab22b6a4904a3c52200bbf17d898c39f09728602d7e7e3fd835f70a1e65b9a29bc712c8b46
-
memory/756-60-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-62-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-58-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-64-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-66-0x000000000041E792-mapping.dmp
-
memory/756-70-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-68-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-57-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/756-78-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/756-83-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/1604-80-0x0000000000945000-0x0000000000956000-memory.dmpFilesize
68KB
-
memory/1604-56-0x0000000000945000-0x0000000000956000-memory.dmpFilesize
68KB
-
memory/1604-79-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/1604-54-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1604-55-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/1668-74-0x0000000000000000-mapping.dmp
-
memory/1668-81-0x0000000000B95000-0x0000000000BA6000-memory.dmpFilesize
68KB
-
memory/1668-82-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/1668-84-0x0000000000B95000-0x0000000000BA6000-memory.dmpFilesize
68KB
-
memory/1668-85-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB