Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 04:04
Static task
static1
Behavioral task
behavioral1
Sample
76563f561fd009f9ec176320657feafa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
76563f561fd009f9ec176320657feafa.exe
Resource
win10v2004-20231222-en
General
-
Target
76563f561fd009f9ec176320657feafa.exe
-
Size
1.5MB
-
MD5
76563f561fd009f9ec176320657feafa
-
SHA1
2f962b8a65165945c3582a49d9a410537abbc964
-
SHA256
92fc50fbd75a13621c3d64e1ded8617c4c9f92072010f0735d050c06ba73d995
-
SHA512
91f6dbf03f60382bdb6e3a2acb9d9b3e985abd23e2d74b1dff1b4a4c487791e7d7c068a85804e92eb67cfaecb4c33da8dbcf953c7f39204e819f1a71e9e3072e
-
SSDEEP
24576:PKaLfALjE7E29i/dB2MJwdLN+93CyfFrwb3RtD5VwlngfdqcKn:jLfALjufc/6yIh2SyfNwbhtD5+lnW6n
Malware Config
Extracted
bitrat
1.38
212.192.246.250:4480
-
communication_password
a86d0c9f7960056a9056c953ba47a617
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2912-4-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-5-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-8-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-9-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-7-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-10-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-11-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-12-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-17-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-23-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-28-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2912-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
vbc.exepid process 2912 vbc.exe 2912 vbc.exe 2912 vbc.exe 2912 vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
76563f561fd009f9ec176320657feafa.exedescription pid process target process PID 2344 set thread context of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
76563f561fd009f9ec176320657feafa.exevbc.exedescription pid process Token: SeDebugPrivilege 2344 76563f561fd009f9ec176320657feafa.exe Token: SeDebugPrivilege 2912 vbc.exe Token: SeShutdownPrivilege 2912 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 2912 vbc.exe 2912 vbc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
76563f561fd009f9ec176320657feafa.execmd.exedescription pid process target process PID 2344 wrote to memory of 2720 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 2720 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 2720 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 2720 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 2912 2344 76563f561fd009f9ec176320657feafa.exe vbc.exe PID 2344 wrote to memory of 1644 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 1644 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 1644 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 1644 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 292 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 292 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 292 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 2344 wrote to memory of 292 2344 76563f561fd009f9ec176320657feafa.exe cmd.exe PID 1644 wrote to memory of 1116 1644 cmd.exe schtasks.exe PID 1644 wrote to memory of 1116 1644 cmd.exe schtasks.exe PID 1644 wrote to memory of 1116 1644 cmd.exe schtasks.exe PID 1644 wrote to memory of 1116 1644 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76563f561fd009f9ec176320657feafa.exe"C:\Users\Admin\AppData\Local\Temp\76563f561fd009f9ec176320657feafa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\76563f561fd009f9ec176320657feafa.exe" "C:\Users\Admin\AppData\Roaming\as/poi\as/poi.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\as/poi\as/poi.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\as/poi\as/poi.exe'" /f1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {BF767DC3-7E4C-4B09-83EA-054C8D4C0AA4} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2344-0-0x0000000000A40000-0x0000000000BC8000-memory.dmpFilesize
1.5MB
-
memory/2344-1-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/2344-2-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2344-26-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/2344-20-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/2912-17-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-19-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-8-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-9-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-7-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-10-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-11-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-12-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-15-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-5-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-13-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2912-4-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-21-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-22-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-23-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-24-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-25-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-3-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-28-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-27-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-29-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2912-30-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB