Analysis
-
max time kernel
137s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-04-2023 11:02
Static task
static1
Behavioral task
behavioral1
Sample
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe
Resource
win10v2004-20230221-en
General
-
Target
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe
-
Size
414KB
-
MD5
a6b99250e1a387291a22be6e12a22f13
-
SHA1
a33c3a5a752a4c72413846a6fc60a5efc2b610c8
-
SHA256
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec
-
SHA512
3063437ef2777b6e19bbb92890eb02c36cf71fa4a7b11f19cd9b9448739351ae92cad61aa8b65f925faa493a719eeaff471f181bb92134e3c3af9fa75317c523
-
SSDEEP
6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUt:ITNYrnE3bm/CiejewY5vO
Malware Config
Extracted
nanocore
1.2.2.0
asporturizm@ddns.net:46218
178.32.224.116:46218
4af74541-e3f1-469c-8af7-efe4071b81cf
-
activate_away_mode
false
-
backup_connection_host
178.32.224.116
- backup_dns_server
-
buffer_size
65535
-
build_time
2018-07-28T12:59:38.488799236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
46218
-
default_group
tourex
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4af74541-e3f1-469c-8af7-efe4071b81cf
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
asporturizm@ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ximo2ubzn1i.exepid process 1044 ximo2ubzn1i.exe -
Loads dropped DLL 1 IoCs
Processes:
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exepid process 1788 0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe" 0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe -
Processes:
regasm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA regasm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ximo2ubzn1i.exedescription pid process target process PID 1044 set thread context of 1420 1044 ximo2ubzn1i.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regasm.exepid process 1420 regasm.exe 1420 regasm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regasm.exepid process 1420 regasm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regasm.exedescription pid process Token: SeDebugPrivilege 1420 regasm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exeximo2ubzn1i.exedescription pid process target process PID 1788 wrote to memory of 1044 1788 0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe ximo2ubzn1i.exe PID 1788 wrote to memory of 1044 1788 0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe ximo2ubzn1i.exe PID 1788 wrote to memory of 1044 1788 0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe ximo2ubzn1i.exe PID 1788 wrote to memory of 1044 1788 0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe ximo2ubzn1i.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe PID 1044 wrote to memory of 1420 1044 ximo2ubzn1i.exe regasm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe"C:\Users\Admin\AppData\Local\Temp\0b2a869538b0dae56ae80ba7a68baef4a2199c4883de2564ef433690142a1dec.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exeFilesize
414KB
MD540edcae6d041aa542f2f3dd39b674d2c
SHA11e3e4cd64b3cfaab312413294a4156a4e0f41756
SHA256ec63ed9ff4224b9f9f11f90ff42e005b04394f92d1a38be9b97ca2dc6945e463
SHA51298a961513ee70bf11b0cdbcc52d2d08f6b4edc91b646eb14ae74470dbe5fd7ae63510dd61b812292c960399b8d1f4007ae4f78c340305b9b49141a08e991ee61
-
C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exeFilesize
414KB
MD540edcae6d041aa542f2f3dd39b674d2c
SHA11e3e4cd64b3cfaab312413294a4156a4e0f41756
SHA256ec63ed9ff4224b9f9f11f90ff42e005b04394f92d1a38be9b97ca2dc6945e463
SHA51298a961513ee70bf11b0cdbcc52d2d08f6b4edc91b646eb14ae74470dbe5fd7ae63510dd61b812292c960399b8d1f4007ae4f78c340305b9b49141a08e991ee61
-
\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exeFilesize
414KB
MD540edcae6d041aa542f2f3dd39b674d2c
SHA11e3e4cd64b3cfaab312413294a4156a4e0f41756
SHA256ec63ed9ff4224b9f9f11f90ff42e005b04394f92d1a38be9b97ca2dc6945e463
SHA51298a961513ee70bf11b0cdbcc52d2d08f6b4edc91b646eb14ae74470dbe5fd7ae63510dd61b812292c960399b8d1f4007ae4f78c340305b9b49141a08e991ee61
-
memory/1044-67-0x0000000004A50000-0x0000000004A90000-memory.dmpFilesize
256KB
-
memory/1044-66-0x0000000000B10000-0x0000000000B7E000-memory.dmpFilesize
440KB
-
memory/1420-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-82-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/1420-86-0x0000000004F50000-0x0000000004F90000-memory.dmpFilesize
256KB
-
memory/1420-85-0x0000000004F50000-0x0000000004F90000-memory.dmpFilesize
256KB
-
memory/1420-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-84-0x0000000004F50000-0x0000000004F90000-memory.dmpFilesize
256KB
-
memory/1420-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1420-78-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-79-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1420-81-0x00000000002B0000-0x00000000002BA000-memory.dmpFilesize
40KB
-
memory/1420-83-0x00000000002C0000-0x00000000002CA000-memory.dmpFilesize
40KB
-
memory/1788-59-0x0000000000300000-0x0000000000340000-memory.dmpFilesize
256KB
-
memory/1788-54-0x0000000000E00000-0x0000000000E6E000-memory.dmpFilesize
440KB
-
memory/1788-55-0x0000000000300000-0x0000000000340000-memory.dmpFilesize
256KB
-
memory/1788-56-0x00000000006E0000-0x000000000071C000-memory.dmpFilesize
240KB