Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 15:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
927KB
-
MD5
8f5920453b064caa5ee67496beab3fd2
-
SHA1
ab3584e9f44da128e5e35f1f247ad9b867272bca
-
SHA256
e776e62db68dc135108e036829e0d3ee1af54534bad98aa13f6ec2aa51ce1b04
-
SHA512
c6910532261655275c29cd5371214ed16a9ef31524ee3dc69a0018ec726fd2efe8915e94e3a9b9ad2d870ac642d292258bb06eae3f1659f851b1bf8668acb330
-
SSDEEP
12288:MGZqU+t8g067Stjib3LTmt+N0lA8hd3uc8vcolhh3HadKBDdzoa1cfN:3gJ0KS9ib/NMfudcolhh3QKBDdEPf
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
127.0.0.1:1665
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-09-09T09:23:36.606577636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
NOV282022
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" file.exe -
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 4332 set thread context of 4764 4332 file.exe file.exe -
Drops file in Program Files directory 2 IoCs
Processes:
file.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe file.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe file.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1728 schtasks.exe 4336 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
file.exepid process 4764 file.exe 4764 file.exe 4764 file.exe 4764 file.exe 4764 file.exe 4764 file.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
file.exepid process 4764 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 4764 file.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
file.exefile.exedescription pid process target process PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4332 wrote to memory of 4764 4332 file.exe file.exe PID 4764 wrote to memory of 1728 4764 file.exe schtasks.exe PID 4764 wrote to memory of 1728 4764 file.exe schtasks.exe PID 4764 wrote to memory of 1728 4764 file.exe schtasks.exe PID 4764 wrote to memory of 4336 4764 file.exe schtasks.exe PID 4764 wrote to memory of 4336 4764 file.exe schtasks.exe PID 4764 wrote to memory of 4336 4764 file.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1155.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1241.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1155.tmpFilesize
1KB
MD55719058dd234db87508ef2540e5d8ff0
SHA1669c8d71202ab3321e6619871705c06864b9c2bd
SHA25674d2ad38b4aa2c15240fd3dcbf8b348c068f94e4ee6b2a9a77672912abe1cb2e
SHA5126cc9107fcf2d73543f3ae2a76b4bcd63b24b8a5156abe247f26a396d00f8afa1d8a3aeb6ec5cc56e62391fff44fef9c0716e8cb47b10a9f1feb4b03f40662790
-
C:\Users\Admin\AppData\Local\Temp\tmp1241.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
memory/1728-139-0x0000000000000000-mapping.dmp
-
memory/4332-132-0x0000000000CE0000-0x0000000000DCE000-memory.dmpFilesize
952KB
-
memory/4332-133-0x0000000005DB0000-0x0000000006354000-memory.dmpFilesize
5.6MB
-
memory/4332-134-0x0000000005750000-0x00000000057E2000-memory.dmpFilesize
584KB
-
memory/4332-135-0x0000000005910000-0x000000000591A000-memory.dmpFilesize
40KB
-
memory/4332-136-0x00000000083A0000-0x000000000843C000-memory.dmpFilesize
624KB
-
memory/4336-141-0x0000000000000000-mapping.dmp
-
memory/4764-137-0x0000000000000000-mapping.dmp
-
memory/4764-138-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4764-143-0x0000000007430000-0x0000000007496000-memory.dmpFilesize
408KB