Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7-20231129-en
General
-
Target
gunzipped.exe
-
Size
594KB
-
MD5
1dc228ba3845e137debb24d881737242
-
SHA1
00af545608674da686d9d84adf056d1c26d8e0fb
-
SHA256
4ba298859e61cb9c39d9d4a4d556fe6357ce0901d5d4ac6f78e6e15ced75cccb
-
SHA512
549bde4f2dd1a5da10d6b4d7c617cf2c70c7123d7139fb9e5aa8373adb044d766ff0003566b094dab27ccfa2c6a13eb52ff2af283a3e641e2c28ee844953679f
-
SSDEEP
12288:nEBU3YlS/ZYajCjq4HGpMqnm04T9op5Us+9wF9DvmwndDq:EBJQZYaGjVGpRm04Tmpt4wnDx
Malware Config
Extracted
nanocore
1.2.2.0
103.167.90.225:4251
tom7.work.gd:4251
948c774c-c1d8-4f57-8709-ed674b265adb
-
activate_away_mode
true
-
backup_connection_host
tom7.work.gd
- backup_dns_server
-
buffer_size
65535
-
build_time
2023-11-01T19:46:43.902018636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4251
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
948c774c-c1d8-4f57-8709-ed674b265adb
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
103.167.90.225
-
primary_dns_server
tom7.work.gd
-
request_elevation
true
-
restart_delay
5000
-
run_delay
10
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gunzipped.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4500 set thread context of 948 4500 gunzipped.exe 96 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3048 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 948 gunzipped.exe 948 gunzipped.exe 948 gunzipped.exe 948 gunzipped.exe 948 gunzipped.exe 948 gunzipped.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 948 gunzipped.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 948 gunzipped.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 4500 wrote to memory of 948 4500 gunzipped.exe 96 PID 948 wrote to memory of 3048 948 gunzipped.exe 97 PID 948 wrote to memory of 3048 948 gunzipped.exe 97 PID 948 wrote to memory of 3048 948 gunzipped.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp89B2.tmp"3⤵
- Creates scheduled task(s)
PID:3048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
1KB
MD542f7159e831591530fb8cdd62d4650a6
SHA15d951d429a25957ca5fc3be282774f148e2f4f81
SHA256aac9dd0d2fd0398d7958c31af596794180e27ba287868cb762878fb470da3cc8
SHA5128439116c6be44e4d1575ea62a7062951605d47af636eb9c292a7e671ebbeee23d14dbb0dae769e87a3ce11877bf41572f7e21a75a0015dbf9d3dfa8b8cc68bbc