nanocore | a367cbca055ecc373dcd99d70585c307dac7cd1f3f32756378dd1c1b369c8d2e

General

Target

b70c112ed968b0846a461d7d3c8e3681383fe28a8b5099c6201cb5bc263c2785.rtf
Size

25KB
MD5

9030afe25461e39f11f8f7239217ca24
SHA1

a47f1de11c15e5901110c29f318314ffbb65326a
SHA256

b70c112ed968b0846a461d7d3c8e3681383fe28a8b5099c6201cb5bc263c2785
SHA512

50b8108d0a23027cd59163784abeacb4a3cce4e9b160176786b420d0febcbd1046b24ca38061bc4bb0cd466a9fddf84e7fa0e3eb68866c7b18a01c717793e47e
SSDEEP

384:6QMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZfAlnjXYtG2eQkp5wDBhPjZ:WFx0XaIsnPRIa4fwJMKlnjXf2e54DDZ

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

tzitziklishop.ddns.net:1665

127.0.0.1:1665

Mutex

54c43eb3-9a5e-48cf-bbb9-9a65e46643a1

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-09-09T09:23:36.606577636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1665
default_group
NOV282022
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
54c43eb3-9a5e-48cf-bbb9-9a65e46643a1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tzitziklishop.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

3 2000 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

catec84736.execatec84736.execatec84736.exe

pid process

1864 catec84736.exe
852 catec84736.exe
1260 catec84736.exe
Loads dropped DLL 2 IoCs

Processes:

EQNEDT32.EXE

pid process

2000 EQNEDT32.EXE
2000 EQNEDT32.EXE

flow	pid	process
3	2000	EQNEDT32.EXE

pid	process
1864	catec84736.exe
852	catec84736.exe
1260	catec84736.exe

pid	process
2000	EQNEDT32.EXE
2000	EQNEDT32.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

catec84736.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	catec84736.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

catec84736.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA catec84736.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

catec84736.exe

description pid process target process

PID 1864 set thread context of 1260 1864 catec84736.exe catec84736.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	catec84736.exe

description	pid	process	target process
PID 1864 set thread context of 1260	1864	catec84736.exe	catec84736.exe

Drops file in Program Files directory 2 IoCs

Processes:

catec84736.exe

description	ioc	process
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	catec84736.exe
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	catec84736.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1780 schtasks.exe
1760 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

2000 EQNEDT32.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1780	schtasks.exe
1760	schtasks.exe

pid	process
2000	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2020 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

catec84736.execatec84736.exe

pid process

1864 catec84736.exe
1864 catec84736.exe
1260 catec84736.exe
1260 catec84736.exe
1260 catec84736.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

catec84736.execatec84736.exe

description pid process

Token: SeDebugPrivilege 1864 catec84736.exe
Token: SeDebugPrivilege 1260 catec84736.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2020 WINWORD.EXE
2020 WINWORD.EXE

pid	process
2020	WINWORD.EXE

pid	process
1864	catec84736.exe
1864	catec84736.exe
1260	catec84736.exe
1260	catec84736.exe
1260	catec84736.exe

description	pid	process
Token: SeDebugPrivilege	1864	catec84736.exe
Token: SeDebugPrivilege	1260	catec84736.exe

pid	process
2020	WINWORD.EXE
2020	WINWORD.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEcatec84736.execatec84736.exe

description	pid	process	target process
PID 2000 wrote to memory of 1864	2000	EQNEDT32.EXE	catec84736.exe
PID 2000 wrote to memory of 1864	2000	EQNEDT32.EXE	catec84736.exe
PID 2000 wrote to memory of 1864	2000	EQNEDT32.EXE	catec84736.exe
PID 2000 wrote to memory of 1864	2000	EQNEDT32.EXE	catec84736.exe
PID 2020 wrote to memory of 676	2020	WINWORD.EXE	splwow64.exe
PID 2020 wrote to memory of 676	2020	WINWORD.EXE	splwow64.exe
PID 2020 wrote to memory of 676	2020	WINWORD.EXE	splwow64.exe
PID 2020 wrote to memory of 676	2020	WINWORD.EXE	splwow64.exe
PID 1864 wrote to memory of 852	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 852	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 852	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 852	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1864 wrote to memory of 1260	1864	catec84736.exe	catec84736.exe
PID 1260 wrote to memory of 1780	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1780	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1780	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1780	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1760	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1760	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1760	1260	catec84736.exe	schtasks.exe
PID 1260 wrote to memory of 1760	1260	catec84736.exe	schtasks.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b70c112ed968b0846a461d7d3c8e3681383fe28a8b5099c6201cb5bc263c2785.rtf"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:676

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Roaming\catec84736.exe
"C:\Users\Admin\AppData\Roaming\catec84736.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\catec84736.exe
"C:\Users\Admin\AppData\Roaming\catec84736.exe"
3⤵
- Executes dropped EXE
PID:852

C:\Users\Admin\AppData\Roaming\catec84736.exe
"C:\Users\Admin\AppData\Roaming\catec84736.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3AA.tmp"
4⤵
- Creates scheduled task(s)
PID:1780

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp531.tmp"
4⤵
- Creates scheduled task(s)
PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3AA.tmp
Filesize
1KB

MD5
011c61b912d6f0e2801438e14622db78

SHA1
9dd8e26834897d0b7bd4f46388516f07287a3b69

SHA256
e2635e6605fa518a3b2d9d37549222883ab4cca29f9ee11b394ebff886558848

SHA512
267b8920b3479ee1bdc2a95b02edb97930515d6aef63f31e16190b05bdcbeab907d61c10dbf2d1076026d819bc5d4d3e235a881cce6a2df1e5cbe6f384225217

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp531.tmp
Filesize
1KB

MD5
0a24db62cb5b84309c4803346caaa25d

SHA1
67660778f61bb44168c33ed3fe56ed86cf9583e8

SHA256
38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df

SHA512
d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548

Download Submit
C:\Users\Admin\AppData\Roaming\catec84736.exe
Filesize
595KB

MD5
4e7706b27fae00c7753de80ca6f3d7b7

SHA1
8275b2c1e523c9dd5de56751a2eff6c4abe914ba

SHA256
1ae495d26ee067e62e53c6490109ecf080801be79fda954d3659615a2343acc5

SHA512
e219db9165c00980261c19e32fb32f669acd2a512bd8757373488b8e4bb3cb50539591bee1404844a52e62ad197fe479326e4a397c5cc00b4163adfd5fd92d5b

Download Submit
C:\Users\Admin\AppData\Roaming\catec84736.exe
Filesize
595KB

MD5
4e7706b27fae00c7753de80ca6f3d7b7

SHA1
8275b2c1e523c9dd5de56751a2eff6c4abe914ba

SHA256
1ae495d26ee067e62e53c6490109ecf080801be79fda954d3659615a2343acc5

SHA512
e219db9165c00980261c19e32fb32f669acd2a512bd8757373488b8e4bb3cb50539591bee1404844a52e62ad197fe479326e4a397c5cc00b4163adfd5fd92d5b

Download Submit
C:\Users\Admin\AppData\Roaming\catec84736.exe
Filesize
595KB

MD5
4e7706b27fae00c7753de80ca6f3d7b7

SHA1
8275b2c1e523c9dd5de56751a2eff6c4abe914ba

SHA256
1ae495d26ee067e62e53c6490109ecf080801be79fda954d3659615a2343acc5

SHA512
e219db9165c00980261c19e32fb32f669acd2a512bd8757373488b8e4bb3cb50539591bee1404844a52e62ad197fe479326e4a397c5cc00b4163adfd5fd92d5b

Download Submit
C:\Users\Admin\AppData\Roaming\catec84736.exe
Filesize
595KB

MD5
4e7706b27fae00c7753de80ca6f3d7b7

SHA1
8275b2c1e523c9dd5de56751a2eff6c4abe914ba

SHA256
1ae495d26ee067e62e53c6490109ecf080801be79fda954d3659615a2343acc5

SHA512
e219db9165c00980261c19e32fb32f669acd2a512bd8757373488b8e4bb3cb50539591bee1404844a52e62ad197fe479326e4a397c5cc00b4163adfd5fd92d5b

Download Submit
\Users\Admin\AppData\Roaming\catec84736.exe
Filesize
595KB

MD5
4e7706b27fae00c7753de80ca6f3d7b7

SHA1
8275b2c1e523c9dd5de56751a2eff6c4abe914ba

SHA256
1ae495d26ee067e62e53c6490109ecf080801be79fda954d3659615a2343acc5

SHA512
e219db9165c00980261c19e32fb32f669acd2a512bd8757373488b8e4bb3cb50539591bee1404844a52e62ad197fe479326e4a397c5cc00b4163adfd5fd92d5b

Download Submit
\Users\Admin\AppData\Roaming\catec84736.exe
Filesize
595KB

MD5
4e7706b27fae00c7753de80ca6f3d7b7

SHA1
8275b2c1e523c9dd5de56751a2eff6c4abe914ba

SHA256
1ae495d26ee067e62e53c6490109ecf080801be79fda954d3659615a2343acc5

SHA512
e219db9165c00980261c19e32fb32f669acd2a512bd8757373488b8e4bb3cb50539591bee1404844a52e62ad197fe479326e4a397c5cc00b4163adfd5fd92d5b

Download Submit
memory/676-68-0x0000000000000000-mapping.dmp

Download
memory/676-69-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/1260-82-0x000000000041E792-mapping.dmp

Download
memory/1260-81-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-95-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/1260-94-0x00000000004A0000-0x00000000004BE000-memory.dmp

Filesize
120KB

Download
memory/1260-93-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/1260-87-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-85-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-78-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-79-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1760-91-0x0000000000000000-mapping.dmp

Download
memory/1780-89-0x0000000000000000-mapping.dmp

Download
memory/1864-73-0x0000000000510000-0x000000000054A000-memory.dmp

Filesize
232KB

Download
memory/1864-72-0x0000000007EC0000-0x0000000007F34000-memory.dmp

Filesize
464KB

Download
memory/1864-71-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1864-70-0x0000000000300000-0x0000000000316000-memory.dmp

Filesize
88KB

Download
memory/1864-62-0x0000000000000000-mapping.dmp

Download
memory/1864-65-0x00000000013A0000-0x000000000143C000-memory.dmp

Filesize
624KB

Download
memory/2020-54-0x00000000724B1000-0x00000000724B4000-memory.dmp

Filesize
12KB

Download
memory/2020-57-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-58-0x0000000070F1D000-0x0000000070F28000-memory.dmp

Filesize
44KB

Download
memory/2020-66-0x0000000070F1D000-0x0000000070F28000-memory.dmp

Filesize
44KB

Download
memory/2020-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2020-55-0x000000006FF31000-0x000000006FF33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads