Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 13:08
General
- Target 74c738ec680d1ff87c135833211a88dd.exe
- Size 5.9MB
- Sample240125-qdbkhshbak
- SHA256 bcb6d900f86664d0a97e69510c99b519f26f376316e761fadf2a8ef4f672b975
Malware Config
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74c738ec680d1ff87c135833211a88dd.exe"C:\Users\Admin\AppData\Local\Temp\74c738ec680d1ff87c135833211a88dd.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\Onion_2.84 (1)-cleaned.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE"C:\Users\Admin\AppData\Local\Temp\BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
BLiTZ_v5.2_2.84_64_Bit_Fixed.EXE
Onion_2.84 (1)-cleaned.exe
memory/452-5-0x0000000005590000-0x00000000055A0000-memory.dmp
memory/452-26-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/452-4-0x00000000053F0000-0x0000000005482000-memory.dmp
memory/452-1-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/452-6-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/452-7-0x0000000005600000-0x0000000005656000-memory.dmp
memory/452-2-0x0000000005290000-0x000000000532C000-memory.dmp
memory/452-3-0x00000000059A0000-0x0000000005F44000-memory.dmp
memory/452-0-0x00000000008A0000-0x000000000091E000-memory.dmp
memory/4724-28-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/4724-27-0x0000000077294000-0x0000000077296000-memory.dmp
memory/4724-21-0x0000000000400000-0x000000000088E000-memory.dmp
memory/4724-29-0x0000000004A00000-0x0000000004A10000-memory.dmp
memory/4724-30-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/4724-31-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/4724-36-0x0000000000400000-0x000000000088E000-memory.dmp
memory/4724-37-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/4724-38-0x0000000004A00000-0x0000000004A10000-memory.dmp
memory/4724-39-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/4724-41-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/4724-42-0x0000000004A00000-0x0000000004A10000-memory.dmp