Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 12:01
Static task
static1
Behavioral task
behavioral1
Sample
89753d8050a2a41c24f85dd57b0a5a72.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
89753d8050a2a41c24f85dd57b0a5a72.exe
Resource
win10v2004-20231215-en
General
-
Target
89753d8050a2a41c24f85dd57b0a5a72.exe
-
Size
262KB
-
MD5
89753d8050a2a41c24f85dd57b0a5a72
-
SHA1
8cb52e457c31bd78c157e7305941135c0db4294f
-
SHA256
f18bd979ea4eb2d374bef76270bc02ac31955bd421b911864ded3b2ccae2fb20
-
SHA512
dc788a715ba4b0ee4cf8450c7ee1e93d3b8b7cf10bb6968c62f7cce141e3bbe63c18feae29f52e590d3b2c27fdc0fc23544de1785b0bd980c882a4742c885230
-
SSDEEP
6144:iS8Gp+df0afmVTRMd/dpn94sLrNXel9Ab98+MA7U:F8YkfXf4TRMx94svNuzAb9ZC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
noki.exepid process 2376 noki.exe -
Loads dropped DLL 1 IoCs
Processes:
89753d8050a2a41c24f85dd57b0a5a72.exepid process 1932 89753d8050a2a41c24f85dd57b0a5a72.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
noki.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\{6CF0A0C8-CEE0-AD4E-46DF-EAE75CAEC9FA} = "C:\\Users\\Admin\\AppData\\Roaming\\Ytawmo\\noki.exe" noki.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
89753d8050a2a41c24f85dd57b0a5a72.exedescription pid process target process PID 1932 set thread context of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 844 2236 WerFault.exe cmd.exe 2312 844 WerFault.exe WerFault.exe -
Processes:
89753d8050a2a41c24f85dd57b0a5a72.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 89753d8050a2a41c24f85dd57b0a5a72.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Privacy 89753d8050a2a41c24f85dd57b0a5a72.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
noki.exepid process 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe 2376 noki.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
89753d8050a2a41c24f85dd57b0a5a72.exedescription pid process Token: SeSecurityPrivilege 1932 89753d8050a2a41c24f85dd57b0a5a72.exe Token: SeSecurityPrivilege 1932 89753d8050a2a41c24f85dd57b0a5a72.exe Token: SeSecurityPrivilege 1932 89753d8050a2a41c24f85dd57b0a5a72.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
89753d8050a2a41c24f85dd57b0a5a72.exenoki.exepid process 1932 89753d8050a2a41c24f85dd57b0a5a72.exe 2376 noki.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
89753d8050a2a41c24f85dd57b0a5a72.exenoki.execmd.exeWerFault.exedescription pid process target process PID 1932 wrote to memory of 2376 1932 89753d8050a2a41c24f85dd57b0a5a72.exe noki.exe PID 1932 wrote to memory of 2376 1932 89753d8050a2a41c24f85dd57b0a5a72.exe noki.exe PID 1932 wrote to memory of 2376 1932 89753d8050a2a41c24f85dd57b0a5a72.exe noki.exe PID 1932 wrote to memory of 2376 1932 89753d8050a2a41c24f85dd57b0a5a72.exe noki.exe PID 2376 wrote to memory of 1108 2376 noki.exe taskhost.exe PID 2376 wrote to memory of 1108 2376 noki.exe taskhost.exe PID 2376 wrote to memory of 1108 2376 noki.exe taskhost.exe PID 2376 wrote to memory of 1108 2376 noki.exe taskhost.exe PID 2376 wrote to memory of 1108 2376 noki.exe taskhost.exe PID 2376 wrote to memory of 1172 2376 noki.exe Dwm.exe PID 2376 wrote to memory of 1172 2376 noki.exe Dwm.exe PID 2376 wrote to memory of 1172 2376 noki.exe Dwm.exe PID 2376 wrote to memory of 1172 2376 noki.exe Dwm.exe PID 2376 wrote to memory of 1172 2376 noki.exe Dwm.exe PID 2376 wrote to memory of 1208 2376 noki.exe Explorer.EXE PID 2376 wrote to memory of 1208 2376 noki.exe Explorer.EXE PID 2376 wrote to memory of 1208 2376 noki.exe Explorer.EXE PID 2376 wrote to memory of 1208 2376 noki.exe Explorer.EXE PID 2376 wrote to memory of 1208 2376 noki.exe Explorer.EXE PID 2376 wrote to memory of 544 2376 noki.exe DllHost.exe PID 2376 wrote to memory of 544 2376 noki.exe DllHost.exe PID 2376 wrote to memory of 544 2376 noki.exe DllHost.exe PID 2376 wrote to memory of 544 2376 noki.exe DllHost.exe PID 2376 wrote to memory of 544 2376 noki.exe DllHost.exe PID 2376 wrote to memory of 1932 2376 noki.exe 89753d8050a2a41c24f85dd57b0a5a72.exe PID 2376 wrote to memory of 1932 2376 noki.exe 89753d8050a2a41c24f85dd57b0a5a72.exe PID 2376 wrote to memory of 1932 2376 noki.exe 89753d8050a2a41c24f85dd57b0a5a72.exe PID 2376 wrote to memory of 1932 2376 noki.exe 89753d8050a2a41c24f85dd57b0a5a72.exe PID 2376 wrote to memory of 1932 2376 noki.exe 89753d8050a2a41c24f85dd57b0a5a72.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 1932 wrote to memory of 2236 1932 89753d8050a2a41c24f85dd57b0a5a72.exe cmd.exe PID 2236 wrote to memory of 844 2236 cmd.exe WerFault.exe PID 2236 wrote to memory of 844 2236 cmd.exe WerFault.exe PID 2236 wrote to memory of 844 2236 cmd.exe WerFault.exe PID 2236 wrote to memory of 844 2236 cmd.exe WerFault.exe PID 2376 wrote to memory of 1624 2376 noki.exe conhost.exe PID 2376 wrote to memory of 1624 2376 noki.exe conhost.exe PID 2376 wrote to memory of 1624 2376 noki.exe conhost.exe PID 2376 wrote to memory of 1624 2376 noki.exe conhost.exe PID 2376 wrote to memory of 1624 2376 noki.exe conhost.exe PID 2376 wrote to memory of 844 2376 noki.exe WerFault.exe PID 2376 wrote to memory of 844 2376 noki.exe WerFault.exe PID 2376 wrote to memory of 844 2376 noki.exe WerFault.exe PID 2376 wrote to memory of 844 2376 noki.exe WerFault.exe PID 2376 wrote to memory of 844 2376 noki.exe WerFault.exe PID 844 wrote to memory of 2312 844 WerFault.exe WerFault.exe PID 844 wrote to memory of 2312 844 WerFault.exe WerFault.exe PID 844 wrote to memory of 2312 844 WerFault.exe WerFault.exe PID 844 wrote to memory of 2312 844 WerFault.exe WerFault.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\89753d8050a2a41c24f85dd57b0a5a72.exe"C:\Users\Admin\AppData\Local\Temp\89753d8050a2a41c24f85dd57b0a5a72.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ytawmo\noki.exe"C:\Users\Admin\AppData\Roaming\Ytawmo\noki.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpceda3d41.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1164⤵
- Program crash
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 5365⤵
- Program crash
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1033111552-42320358-1725152531802477302890655629-1141367883-1312066316-952559566"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Ejym\kaumi.jalFilesize
366B
MD534a9c8b2b34b6ef36871fab4537d5ce8
SHA1121ff7e7531589a273a4be0088312b3158ee3372
SHA256fa85de9a407c9a3f20a66528ec949ce645c8d32bd7467e3d1f2d7771b220d4e3
SHA51284d461b44ec52a5bd40c891d27024b9c5d42727fb5908b30f4c6a95687ad1e273bbea57cdee486b654746e14691d40fb54b9232e3071dda23c8dc835af9a07bc
-
\Users\Admin\AppData\Roaming\Ytawmo\noki.exeFilesize
262KB
MD5b6a4799b690622afc4f13cfcc7145625
SHA105729973c01acece086b0a01005f6699d749e186
SHA256357fe5456b906d51b8cf00f745f5f055678894da3b155ab76559d21a444afa59
SHA512e6e27a5652f8fb71afea0bd98b484d5597bc402a15d4d41543b1a925390c551e87c31576e0d6d6ff39071f9220a641bdf1108a8a86368f47a75261e943f185e8
-
memory/544-49-0x0000000001E90000-0x0000000001ED1000-memory.dmpFilesize
260KB
-
memory/544-47-0x0000000001E90000-0x0000000001ED1000-memory.dmpFilesize
260KB
-
memory/544-45-0x0000000001E90000-0x0000000001ED1000-memory.dmpFilesize
260KB
-
memory/544-43-0x0000000001E90000-0x0000000001ED1000-memory.dmpFilesize
260KB
-
memory/1108-15-0x0000000001F50000-0x0000000001F91000-memory.dmpFilesize
260KB
-
memory/1108-20-0x0000000001F50000-0x0000000001F91000-memory.dmpFilesize
260KB
-
memory/1108-23-0x0000000001F50000-0x0000000001F91000-memory.dmpFilesize
260KB
-
memory/1108-25-0x0000000001F50000-0x0000000001F91000-memory.dmpFilesize
260KB
-
memory/1108-27-0x0000000001F50000-0x0000000001F91000-memory.dmpFilesize
260KB
-
memory/1172-32-0x0000000001CB0000-0x0000000001CF1000-memory.dmpFilesize
260KB
-
memory/1172-34-0x0000000001CB0000-0x0000000001CF1000-memory.dmpFilesize
260KB
-
memory/1172-33-0x0000000001CB0000-0x0000000001CF1000-memory.dmpFilesize
260KB
-
memory/1172-31-0x0000000001CB0000-0x0000000001CF1000-memory.dmpFilesize
260KB
-
memory/1208-40-0x0000000002150000-0x0000000002191000-memory.dmpFilesize
260KB
-
memory/1208-39-0x0000000002150000-0x0000000002191000-memory.dmpFilesize
260KB
-
memory/1208-38-0x0000000002150000-0x0000000002191000-memory.dmpFilesize
260KB
-
memory/1208-37-0x0000000002150000-0x0000000002191000-memory.dmpFilesize
260KB
-
memory/1932-68-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-65-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-179-0x0000000001EB0000-0x0000000001EF1000-memory.dmpFilesize
260KB
-
memory/1932-178-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1932-13-0x0000000001EB0000-0x0000000001EF5000-memory.dmpFilesize
276KB
-
memory/1932-1-0x0000000000380000-0x00000000003C5000-memory.dmpFilesize
276KB
-
memory/1932-2-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1932-6-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1932-3-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1932-5-0x0000000000290000-0x00000000002D1000-memory.dmpFilesize
260KB
-
memory/1932-4-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1932-53-0x0000000001EB0000-0x0000000001EF1000-memory.dmpFilesize
260KB
-
memory/1932-55-0x0000000001EB0000-0x0000000001EF1000-memory.dmpFilesize
260KB
-
memory/1932-57-0x0000000001EB0000-0x0000000001EF1000-memory.dmpFilesize
260KB
-
memory/1932-59-0x0000000001EB0000-0x0000000001EF1000-memory.dmpFilesize
260KB
-
memory/1932-61-0x0000000001EB0000-0x0000000001EF1000-memory.dmpFilesize
260KB
-
memory/1932-62-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-155-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-66-0x0000000077C50000-0x0000000077C51000-memory.dmpFilesize
4KB
-
memory/1932-64-0x0000000077C50000-0x0000000077C51000-memory.dmpFilesize
4KB
-
memory/1932-0-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1932-70-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-72-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-74-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-76-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-78-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-80-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1932-82-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/2376-19-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/2376-16-0x0000000001C40000-0x0000000001C85000-memory.dmpFilesize
276KB
-
memory/2376-18-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2376-21-0x0000000001BF0000-0x0000000001C31000-memory.dmpFilesize
260KB
-
memory/2376-197-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB