Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 14:13

General

  • Target

    74c738ec680d1ff87c135833211a88dd.exe

  • Size

    5.9MB

  • MD5

    74c738ec680d1ff87c135833211a88dd

  • SHA1

    12040b15530b5b80de79faa122d095341c388b60

  • SHA256

    bcb6d900f86664d0a97e69510c99b519f26f376316e761fadf2a8ef4f672b975

  • SHA512

    a002eaf05daa6b8826fb73fe4beef075c647ceb0a59198ae223329497b92487fd2a029ad0a7c1bd13656e02d9d22506a148dbe46733b89ed675b77c8aae07ad1

  • SSDEEP

    49152:VDIMT1Lr5k16MadwH/MiaK+zRHhHreL+lcTQxexi5rFN9rr1x0QDQcUhoecxyA+P:pm

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74c738ec680d1ff87c135833211a88dd.exe
    "C:\Users\Admin\AppData\Local\Temp\74c738ec680d1ff87c135833211a88dd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe
      "C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1928
    • C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE
      "C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE"
      2⤵
      • Executes dropped EXE
      PID:1856

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE

          Filesize

          164KB

          MD5

          887cf56ee8422bbab6ef2d036ad280cb

          SHA1

          2cbe422c60b51253db6f4bb59dfe08c98ec6c047

          SHA256

          2f6ce59e336aa60780cf3533f1db8c5755a2e106a6cfe19948876207b8f9e26b

          SHA512

          d61720e9bad8779ee0efe3fc3ed4495c6cd3c5314c04d83e2fc5d800639a3bb4f215eacfaf8f57501c86b862a143dbff7a018f1123c10a4c88a99e10e3a2e422

        • C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE

          Filesize

          32KB

          MD5

          68f4261c11bf82e9910904760a839d21

          SHA1

          baecc9b629846d124c15da232f0dd5e14dfa0890

          SHA256

          057a609719f60e996c79cb83ccbf058f730b99e0d59958771197e356960c53d3

          SHA512

          2b298edab634aeee8e1014f06ceed26e028ea42de8100e86c340e46e33dcec658aa0ce8ec14a467aa624c5aaf8939cd787621b351a8ddb182ceaf37246d49ae2

        • C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE

          Filesize

          3KB

          MD5

          e9d9350db7bfb3c40ec0b2dc2d656e89

          SHA1

          8d1a9600e13d73a3ab25f4a8358a9dba0123c6b3

          SHA256

          4a40d3c4146cb0e3235f277959a7057d8368190f6a1ae38b24a27586718ec41c

          SHA512

          04f36156e4ded47d792d380cbd299fcf87f7d934271084ad784586d808d495bc5a4e827bef317630d5930cc948fcf1ce4455b1a67190d15dc8508c30762a347b

        • C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe

          Filesize

          104KB

          MD5

          57ba73427cde91ad57f4472d09b62921

          SHA1

          7eb6d00a4998f4f4789d779a769a14835d8a01e7

          SHA256

          01458f77180e6e9fdafbac37e867d416afb07ac7b794ce6e2accb3ecc08083c1

          SHA512

          405da5ed8f264249dbca303314733b77b0a18f525209c1288c203822151e873b8e4189eecda1cddea27bb1af66af9fe6542cebc320ad582e8ea5ca8a3c453f33

        • C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe

          Filesize

          138KB

          MD5

          a203546462872fef13ad6021a3f39c36

          SHA1

          215dbb6beb1c835f0941225dae81a7015e15f3e1

          SHA256

          385410968b706ba7185ab472e2d3ef74024448919885cc9c4345e2a8762b4dbb

          SHA512

          ee120b68ae920c3e04775f1bd1f5e27495c6f7e355f442d0c6c1ec61ab634cc2029a11141c31db2111c89b12ebbef8127aaadc49f16f14b92e2d6b1178d33882

        • C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe

          Filesize

          148KB

          MD5

          e728e6770f979b4c8ebbce5f5505b032

          SHA1

          6f3849f50ad4d17e1c708803954eb7337511c2a2

          SHA256

          6beb9678e0dbce9ec3b85de0442e95aebdc6eab2183cc0ef680c519efb2a0c43

          SHA512

          e4023e84c8022f1e6f696ac3e3acd9239cc6377a0cb6d6fe47b581847b3bb928900911687c0e63cd43cc375f372156bbb89fdf6b7eec1a8150a9f043dc89d6aa

        • memory/1928-33-0x0000000004A90000-0x0000000004AA0000-memory.dmp

          Filesize

          64KB

        • memory/1928-28-0x00000000745D0000-0x0000000074B81000-memory.dmp

          Filesize

          5.7MB

        • memory/1928-43-0x0000000004A90000-0x0000000004AA0000-memory.dmp

          Filesize

          64KB

        • memory/1928-42-0x00000000745D0000-0x0000000074B81000-memory.dmp

          Filesize

          5.7MB

        • memory/1928-40-0x0000000004A90000-0x0000000004AA0000-memory.dmp

          Filesize

          64KB

        • memory/1928-41-0x00000000745D0000-0x0000000074B81000-memory.dmp

          Filesize

          5.7MB

        • memory/1928-21-0x0000000000400000-0x000000000088E000-memory.dmp

          Filesize

          4.6MB

        • memory/1928-38-0x00000000745D0000-0x0000000074B81000-memory.dmp

          Filesize

          5.7MB

        • memory/1928-37-0x0000000000400000-0x000000000088E000-memory.dmp

          Filesize

          4.6MB

        • memory/1928-31-0x00000000745D0000-0x0000000074B81000-memory.dmp

          Filesize

          5.7MB

        • memory/1928-27-0x0000000077444000-0x0000000077446000-memory.dmp

          Filesize

          8KB

        • memory/1928-30-0x00000000745D0000-0x0000000074B81000-memory.dmp

          Filesize

          5.7MB

        • memory/1928-29-0x0000000004A90000-0x0000000004AA0000-memory.dmp

          Filesize

          64KB

        • memory/4924-7-0x0000000005D90000-0x0000000005DE6000-memory.dmp

          Filesize

          344KB

        • memory/4924-2-0x00000000059C0000-0x0000000005A5C000-memory.dmp

          Filesize

          624KB

        • memory/4924-1-0x0000000074930000-0x00000000750E0000-memory.dmp

          Filesize

          7.7MB

        • memory/4924-0-0x0000000000FE0000-0x000000000105E000-memory.dmp

          Filesize

          504KB

        • memory/4924-3-0x0000000006060000-0x0000000006604000-memory.dmp

          Filesize

          5.6MB

        • memory/4924-26-0x0000000074930000-0x00000000750E0000-memory.dmp

          Filesize

          7.7MB

        • memory/4924-4-0x0000000005B50000-0x0000000005BE2000-memory.dmp

          Filesize

          584KB

        • memory/4924-5-0x0000000005D80000-0x0000000005D90000-memory.dmp

          Filesize

          64KB

        • memory/4924-6-0x0000000005AF0000-0x0000000005AFA000-memory.dmp

          Filesize

          40KB