Analysis
-
max time kernel
80s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-04-2023 18:56
Static task
static1
Behavioral task
behavioral1
Sample
129940eb6b4747b1569e7da5f37157db.exe
Resource
win7-20230220-en
General
-
Target
129940eb6b4747b1569e7da5f37157db.exe
-
Size
762KB
-
MD5
129940eb6b4747b1569e7da5f37157db
-
SHA1
833dbea5d5f6f2b6bf1f24d9ca2c6d807804b6d9
-
SHA256
7ba9294f10f99747124f01c3564c8a127057507932edda9806476f186e534c32
-
SHA512
3272119368abc30454d2ff1f4430aa30b2f0e71999f4c32dceae7b28d925210f3d79d1f50ae797270f2641c5d5f8344cb6728fdbbfb4654cf829778e68086d68
-
SSDEEP
12288:z1VLXCxGmsXPqiPnXkATcCPqcPRh17SMJU9fkPCldfKVWjzDYRw6gXZjZ81GidIL:RVLXkGXPqiPnXkAICx5hxSM68ydSqHp7
Malware Config
Extracted
nanocore
1.2.2.0
iyhto.ddns.net:3531
42c7bb0d-2a49-4c9a-b8e7-5ee248f484c7
-
activate_away_mode
true
-
backup_connection_host
iyhto.ddns.net
- backup_dns_server
-
buffer_size
65535
-
build_time
2020-08-18T04:21:38.557873036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3531
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
42c7bb0d-2a49-4c9a-b8e7-5ee248f484c7
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
iyhto.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Service = "C:\\Program Files (x86)\\IMAP Service\\imapsvc.exe" 129940eb6b4747b1569e7da5f37157db.exe -
Processes:
129940eb6b4747b1569e7da5f37157db.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 129940eb6b4747b1569e7da5f37157db.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exedescription pid process target process PID 1228 set thread context of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe -
Drops file in Program Files directory 2 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exedescription ioc process File created C:\Program Files (x86)\IMAP Service\imapsvc.exe 129940eb6b4747b1569e7da5f37157db.exe File opened for modification C:\Program Files (x86)\IMAP Service\imapsvc.exe 129940eb6b4747b1569e7da5f37157db.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exepowershell.exe129940eb6b4747b1569e7da5f37157db.exepid process 1228 129940eb6b4747b1569e7da5f37157db.exe 1228 129940eb6b4747b1569e7da5f37157db.exe 1476 powershell.exe 996 129940eb6b4747b1569e7da5f37157db.exe 996 129940eb6b4747b1569e7da5f37157db.exe 996 129940eb6b4747b1569e7da5f37157db.exe 996 129940eb6b4747b1569e7da5f37157db.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exepid process 996 129940eb6b4747b1569e7da5f37157db.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exepowershell.exe129940eb6b4747b1569e7da5f37157db.exedescription pid process Token: SeDebugPrivilege 1228 129940eb6b4747b1569e7da5f37157db.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 996 129940eb6b4747b1569e7da5f37157db.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
129940eb6b4747b1569e7da5f37157db.exedescription pid process target process PID 1228 wrote to memory of 1476 1228 129940eb6b4747b1569e7da5f37157db.exe powershell.exe PID 1228 wrote to memory of 1476 1228 129940eb6b4747b1569e7da5f37157db.exe powershell.exe PID 1228 wrote to memory of 1476 1228 129940eb6b4747b1569e7da5f37157db.exe powershell.exe PID 1228 wrote to memory of 1476 1228 129940eb6b4747b1569e7da5f37157db.exe powershell.exe PID 1228 wrote to memory of 836 1228 129940eb6b4747b1569e7da5f37157db.exe schtasks.exe PID 1228 wrote to memory of 836 1228 129940eb6b4747b1569e7da5f37157db.exe schtasks.exe PID 1228 wrote to memory of 836 1228 129940eb6b4747b1569e7da5f37157db.exe schtasks.exe PID 1228 wrote to memory of 836 1228 129940eb6b4747b1569e7da5f37157db.exe schtasks.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe PID 1228 wrote to memory of 996 1228 129940eb6b4747b1569e7da5f37157db.exe 129940eb6b4747b1569e7da5f37157db.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\129940eb6b4747b1569e7da5f37157db.exe"C:\Users\Admin\AppData\Local\Temp\129940eb6b4747b1569e7da5f37157db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QDciObviIKfRDf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QDciObviIKfRDf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC572.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\129940eb6b4747b1569e7da5f37157db.exe"C:\Users\Admin\AppData\Local\Temp\129940eb6b4747b1569e7da5f37157db.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC572.tmpFilesize
1KB
MD5b8baeb375422a4f55be78d65a9bab282
SHA11b0ecac768b91c27a5c91e98ddce1e164354959a
SHA25615517bcc083383416e7cf9c7298b7f06d60b451377fddb39f03b9bea040050fc
SHA5121cdebed83d003735bd8d6437ce91a45105fff76321490378ed7f3543fd208100ecc29b1433ccaaa13052cf6c04f54616f77d0c4d6ebb8bd03fd9e5fff71256d5
-
memory/996-90-0x00000000006D0000-0x00000000006EA000-memory.dmpFilesize
104KB
-
memory/996-92-0x0000000000B60000-0x0000000000B72000-memory.dmpFilesize
72KB
-
memory/996-100-0x00000000044B0000-0x00000000044C4000-memory.dmpFilesize
80KB
-
memory/996-99-0x0000000004970000-0x000000000499E000-memory.dmpFilesize
184KB
-
memory/996-79-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-98-0x0000000000FC0000-0x0000000000FCE000-memory.dmpFilesize
56KB
-
memory/996-97-0x0000000000E40000-0x0000000000E54000-memory.dmpFilesize
80KB
-
memory/996-82-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/996-96-0x0000000000CB0000-0x0000000000CC0000-memory.dmpFilesize
64KB
-
memory/996-83-0x00000000004B0000-0x00000000004CE000-memory.dmpFilesize
120KB
-
memory/996-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-73-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/996-75-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-77-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-95-0x0000000000CA0000-0x0000000000CB4000-memory.dmpFilesize
80KB
-
memory/996-94-0x0000000000C10000-0x0000000000C1E000-memory.dmpFilesize
56KB
-
memory/996-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/996-84-0x0000000000490000-0x000000000049A000-memory.dmpFilesize
40KB
-
memory/996-93-0x0000000000BC0000-0x0000000000BCC000-memory.dmpFilesize
48KB
-
memory/996-91-0x0000000000B50000-0x0000000000B5E000-memory.dmpFilesize
56KB
-
memory/996-89-0x00000000006C0000-0x00000000006D2000-memory.dmpFilesize
72KB
-
memory/1228-54-0x0000000000FD0000-0x0000000001094000-memory.dmpFilesize
784KB
-
memory/1228-56-0x0000000000550000-0x0000000000564000-memory.dmpFilesize
80KB
-
memory/1228-66-0x0000000000B80000-0x0000000000B86000-memory.dmpFilesize
24KB
-
memory/1228-59-0x0000000000560000-0x000000000056C000-memory.dmpFilesize
48KB
-
memory/1228-69-0x0000000000E50000-0x0000000000E8C000-memory.dmpFilesize
240KB
-
memory/1228-55-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/1228-60-0x00000000079B0000-0x0000000007A32000-memory.dmpFilesize
520KB
-
memory/1228-58-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/1228-57-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/1476-86-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/1476-85-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB