Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 06:15
Static task
static1
Behavioral task
behavioral1
Sample
e0f6bbc12ebe2102cf3fcf74f9d690d9.exe
Resource
win7-20240220-en
General
-
Target
e0f6bbc12ebe2102cf3fcf74f9d690d9.exe
-
Size
697KB
-
MD5
e0f6bbc12ebe2102cf3fcf74f9d690d9
-
SHA1
203b28ec0fcb113bf1ac37ffba917b94cab9e85b
-
SHA256
35d212409544435a45ce577615da11f75cc4cf6dc56bce849651aede5c1ae437
-
SHA512
7e711a6a18d561244413b9ebcfba52ed353d8eea3ecd379a39038a172ed4a2b31e5ddead87d0a6d969a9edf7c3fe782852733a5a55862fd6ed2a164161fcadc6
-
SSDEEP
12288:ETy8p17iS/d348K13c//sqQonbTWPsUwmxEHr9b8GcH3uExo4Kiazs:EPpMS/d34S//LQonbTAsUwmWrV8GcHJe
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.100:1985
127.0.0.1:1985
b10f8b74-4448-4597-840b-1e44a5084bfc
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-04-30T10:29:24.181451236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1985
-
default_group
OBO
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b10f8b74-4448-4597-840b-1e44a5084bfc
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
79.134.225.100
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2360-3-0x00000000007F0000-0x0000000000802000-memory.dmp CustAttr -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e0f6bbc12ebe2102cf3fcf74f9d690d9.exedescription pid process target process PID 2360 set thread context of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\TCP Subsystem\tcpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\TCP Subsystem\tcpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
e0f6bbc12ebe2102cf3fcf74f9d690d9.exeRegSvcs.exepowershell.exepid process 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe 2468 RegSvcs.exe 2468 RegSvcs.exe 2468 RegSvcs.exe 2444 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2468 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e0f6bbc12ebe2102cf3fcf74f9d690d9.exeRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe Token: SeDebugPrivilege 2468 RegSvcs.exe Token: SeDebugPrivilege 2444 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e0f6bbc12ebe2102cf3fcf74f9d690d9.exedescription pid process target process PID 2360 wrote to memory of 2444 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe powershell.exe PID 2360 wrote to memory of 2444 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe powershell.exe PID 2360 wrote to memory of 2444 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe powershell.exe PID 2360 wrote to memory of 2444 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe powershell.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe PID 2360 wrote to memory of 2468 2360 e0f6bbc12ebe2102cf3fcf74f9d690d9.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0f6bbc12ebe2102cf3fcf74f9d690d9.exe"C:\Users\Admin\AppData\Local\Temp\e0f6bbc12ebe2102cf3fcf74f9d690d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e0f6bbc12ebe2102cf3fcf74f9d690d9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-19-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2360-1-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2360-2-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2360-3-0x00000000007F0000-0x0000000000802000-memory.dmpFilesize
72KB
-
memory/2360-4-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2360-5-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2360-6-0x00000000055E0000-0x0000000005662000-memory.dmpFilesize
520KB
-
memory/2360-7-0x0000000001EE0000-0x0000000001F1A000-memory.dmpFilesize
232KB
-
memory/2360-0-0x0000000000870000-0x0000000000924000-memory.dmpFilesize
720KB
-
memory/2444-29-0x000000006FA00000-0x000000006FFAB000-memory.dmpFilesize
5.7MB
-
memory/2444-30-0x0000000002A20000-0x0000000002A60000-memory.dmpFilesize
256KB
-
memory/2444-33-0x000000006FA00000-0x000000006FFAB000-memory.dmpFilesize
5.7MB
-
memory/2444-32-0x0000000002A20000-0x0000000002A60000-memory.dmpFilesize
256KB
-
memory/2444-31-0x000000006FA00000-0x000000006FFAB000-memory.dmpFilesize
5.7MB
-
memory/2468-21-0x0000000004720000-0x0000000004760000-memory.dmpFilesize
256KB
-
memory/2468-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-20-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2468-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-26-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/2468-27-0x00000000004A0000-0x00000000004BE000-memory.dmpFilesize
120KB
-
memory/2468-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-28-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/2468-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2468-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2468-34-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2468-35-0x0000000004720000-0x0000000004760000-memory.dmpFilesize
256KB