Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 01:19
Static task
static1
Behavioral task
behavioral1
Sample
1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe
Resource
win7-20230220-en
General
-
Target
1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe
-
Size
369KB
-
MD5
43209bda3c2993ca22a38d243a8e7747
-
SHA1
a684fb8f5063e5f130fff32d668741c3cc016698
-
SHA256
1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4
-
SHA512
d2f251870595fae9fb72e9582935dc6d16d2490cd0a42cff794e151855b5edd6efd221922b8fc286e0e458209126118cc24d705e5070169771f9b34c8ec909fa
-
SSDEEP
6144:m7XJ+YM8OJ7mEkoAUz1qp2fHmiIth7PkQm1aZX4:mN+Y47myAUzUseicPlN
Malware Config
Extracted
nanocore
1.2.2.0
blessed1234.duckdns.org:2023
a8941196-a5c4-4b0f-ba02-65265f59a258
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-12-30T14:36:15.993957836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2023
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a8941196-a5c4-4b0f-ba02-65265f59a258
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
blessed1234.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 1872 svchost.exe 332 svchost.exe 1944 svchost.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exesvchost.exesvchost.exedescription pid process target process PID 2032 set thread context of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 1872 set thread context of 1000 1872 svchost.exe RegAsm.exe PID 332 set thread context of 1764 332 svchost.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1308 schtasks.exe 864 schtasks.exe 1852 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegAsm.exepid process 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1736 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1736 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.execmd.exetaskeng.exesvchost.execmd.exedescription pid process target process PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 1736 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe RegAsm.exe PID 2032 wrote to memory of 320 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 320 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 320 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 320 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1628 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1628 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1628 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1628 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1768 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1768 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1768 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 2032 wrote to memory of 1768 2032 1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe cmd.exe PID 1628 wrote to memory of 1308 1628 cmd.exe schtasks.exe PID 1628 wrote to memory of 1308 1628 cmd.exe schtasks.exe PID 1628 wrote to memory of 1308 1628 cmd.exe schtasks.exe PID 1628 wrote to memory of 1308 1628 cmd.exe schtasks.exe PID 436 wrote to memory of 1872 436 taskeng.exe svchost.exe PID 436 wrote to memory of 1872 436 taskeng.exe svchost.exe PID 436 wrote to memory of 1872 436 taskeng.exe svchost.exe PID 436 wrote to memory of 1872 436 taskeng.exe svchost.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1000 1872 svchost.exe RegAsm.exe PID 1872 wrote to memory of 1800 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1800 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1800 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1800 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 960 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 960 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 960 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 960 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1460 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1460 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1460 1872 svchost.exe cmd.exe PID 1872 wrote to memory of 1460 1872 svchost.exe cmd.exe PID 960 wrote to memory of 864 960 cmd.exe schtasks.exe PID 960 wrote to memory of 864 960 cmd.exe schtasks.exe PID 960 wrote to memory of 864 960 cmd.exe schtasks.exe PID 960 wrote to memory of 864 960 cmd.exe schtasks.exe PID 436 wrote to memory of 332 436 taskeng.exe svchost.exe PID 436 wrote to memory of 332 436 taskeng.exe svchost.exe PID 436 wrote to memory of 332 436 taskeng.exe svchost.exe PID 436 wrote to memory of 332 436 taskeng.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe"C:\Users\Admin\AppData\Local\Temp\1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\1db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {A839C777-0A36-486E-9817-83F1F2DC0BDF} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeFilesize
369KB
MD543209bda3c2993ca22a38d243a8e7747
SHA1a684fb8f5063e5f130fff32d668741c3cc016698
SHA2561db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4
SHA512d2f251870595fae9fb72e9582935dc6d16d2490cd0a42cff794e151855b5edd6efd221922b8fc286e0e458209126118cc24d705e5070169771f9b34c8ec909fa
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeFilesize
369KB
MD543209bda3c2993ca22a38d243a8e7747
SHA1a684fb8f5063e5f130fff32d668741c3cc016698
SHA2561db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4
SHA512d2f251870595fae9fb72e9582935dc6d16d2490cd0a42cff794e151855b5edd6efd221922b8fc286e0e458209126118cc24d705e5070169771f9b34c8ec909fa
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeFilesize
369KB
MD543209bda3c2993ca22a38d243a8e7747
SHA1a684fb8f5063e5f130fff32d668741c3cc016698
SHA2561db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4
SHA512d2f251870595fae9fb72e9582935dc6d16d2490cd0a42cff794e151855b5edd6efd221922b8fc286e0e458209126118cc24d705e5070169771f9b34c8ec909fa
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeFilesize
369KB
MD543209bda3c2993ca22a38d243a8e7747
SHA1a684fb8f5063e5f130fff32d668741c3cc016698
SHA2561db6c88a75febdf163850df7ee78b92841542e7c779046ee8d39ee64a312c9d4
SHA512d2f251870595fae9fb72e9582935dc6d16d2490cd0a42cff794e151855b5edd6efd221922b8fc286e0e458209126118cc24d705e5070169771f9b34c8ec909fa
-
memory/332-114-0x0000000000670000-0x00000000006B0000-memory.dmpFilesize
256KB
-
memory/332-113-0x00000000000D0000-0x0000000000132000-memory.dmpFilesize
392KB
-
memory/1000-111-0x0000000000550000-0x0000000000590000-memory.dmpFilesize
256KB
-
memory/1000-110-0x0000000000550000-0x0000000000590000-memory.dmpFilesize
256KB
-
memory/1000-109-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1000-106-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1000-102-0x0000000000090000-0x00000000000C8000-memory.dmpFilesize
224KB
-
memory/1736-70-0x00000000003D0000-0x00000000003DA000-memory.dmpFilesize
40KB
-
memory/1736-90-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/1736-72-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/1736-74-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/1736-76-0x00000000004F0000-0x0000000000502000-memory.dmpFilesize
72KB
-
memory/1736-77-0x0000000000540000-0x000000000055A000-memory.dmpFilesize
104KB
-
memory/1736-78-0x0000000000570000-0x000000000057E000-memory.dmpFilesize
56KB
-
memory/1736-79-0x0000000000820000-0x0000000000832000-memory.dmpFilesize
72KB
-
memory/1736-80-0x0000000000830000-0x000000000083C000-memory.dmpFilesize
48KB
-
memory/1736-81-0x00000000009E0000-0x00000000009EE000-memory.dmpFilesize
56KB
-
memory/1736-82-0x00000000009F0000-0x0000000000A04000-memory.dmpFilesize
80KB
-
memory/1736-83-0x0000000000A40000-0x0000000000A50000-memory.dmpFilesize
64KB
-
memory/1736-84-0x0000000000A90000-0x0000000000AA4000-memory.dmpFilesize
80KB
-
memory/1736-85-0x0000000000AA0000-0x0000000000AAE000-memory.dmpFilesize
56KB
-
memory/1736-86-0x0000000000CE0000-0x0000000000D0E000-memory.dmpFilesize
184KB
-
memory/1736-87-0x0000000000BC0000-0x0000000000BD4000-memory.dmpFilesize
80KB
-
memory/1736-89-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/1736-71-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/1736-56-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1736-69-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/1736-57-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1736-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1736-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1736-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1736-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1736-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1736-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1764-125-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1764-126-0x0000000004E40000-0x0000000004E80000-memory.dmpFilesize
256KB
-
memory/1872-94-0x0000000004260000-0x00000000042A0000-memory.dmpFilesize
256KB
-
memory/1872-93-0x0000000000330000-0x0000000000392000-memory.dmpFilesize
392KB
-
memory/1944-128-0x0000000000D40000-0x0000000000DA2000-memory.dmpFilesize
392KB
-
memory/1944-129-0x0000000000C90000-0x0000000000CD0000-memory.dmpFilesize
256KB
-
memory/2032-54-0x0000000000C70000-0x0000000000CD2000-memory.dmpFilesize
392KB
-
memory/2032-55-0x0000000000B40000-0x0000000000B80000-memory.dmpFilesize
256KB