Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 13:06
Static task
static1
Behavioral task
behavioral1
Sample
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe
Resource
win7-20240221-en
General
-
Target
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe
-
Size
776KB
-
MD5
e1bdba8cd7ae8d8f3fe039b5ee58b88d
-
SHA1
b61a538cdbe88e5f9c769006147d64f93117f890
-
SHA256
b7f93fdcba04537197b4d1a307bf54da300480074376b631c82c1a2c903a5db5
-
SHA512
ff17d6743cf79d9753c4a923264ad3eeff999e6d9ed9e119e3c9b05529dddbf06797e676dfc43f3112025845c9b9f038bda2d4f562fcc9d5f43134fd2e37bfbb
-
SSDEEP
6144:J85JVCO4nPDZvWekYzl23aPfulMJyn/2ENzDScV33TKtJWTlksz/DrPwjqh3O2oC:JqVCjDZuyTSMGJ3TKTmFDzPMar0
Malware Config
Extracted
nanocore
1.2.2.0
godisgood1.hopto.org:7712
9ed8d108-2eb1-4e23-9679-783796e4baff
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-04-23T17:16:53.813634136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7712
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9ed8d108-2eb1-4e23-9679-783796e4baff
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
godisgood1.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Host = "C:\\Program Files (x86)\\NAS Host\\nashost.exe" e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exedescription pid process target process PID 2176 set thread context of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Drops file in Program Files directory 2 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exedescription ioc process File created C:\Program Files (x86)\NAS Host\nashost.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe File opened for modification C:\Program Files (x86)\NAS Host\nashost.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2232 schtasks.exe 2596 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exepid process 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exepid process 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exedescription pid process Token: SeDebugPrivilege 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
e1bdba8cd7ae8d8f3fe039b5ee58b88d.exee1bdba8cd7ae8d8f3fe039b5ee58b88d.exedescription pid process target process PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2176 wrote to memory of 2560 2176 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe PID 2560 wrote to memory of 2232 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2232 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2232 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2232 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2596 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2596 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2596 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe PID 2560 wrote to memory of 2596 2560 e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe"C:\Users\Admin\AppData\Local\Temp\e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe"C:\Users\Admin\AppData\Local\Temp\e1bdba8cd7ae8d8f3fe039b5ee58b88d.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NAS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE9D2.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NAS Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEB98.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE9D2.tmpFilesize
1KB
MD5e7a34760990c1d3fbee9bc02d29dc99d
SHA19f786674de276ad569c7feedb603da84f8bca005
SHA25671a53813f3cbf5855d227dace93eb53f5460f947af05eade10ebfdf4d2c67fc4
SHA512fd9435696648e4533d2ca55111a338549eba5444c4fc0400168e03bf1241424f538ef9f912d7f35f7f576ef10dc3620f97dbd07fda6132a7e514ceedef8847f7
-
C:\Users\Admin\AppData\Local\Temp\tmpEB98.tmpFilesize
1KB
MD59f554f602c22cfc20079e966d177fadb
SHA1789baa3425849bf239e47c6bcf352e6693a8c337
SHA2564c760d5fe0c06cf4bf554170870f41181c61a217c37eb826903094dda86dd1f1
SHA512b83e3e97dbe38ec4c64d9bef65e2521416f2d7434d78d05e66f729a2e0fbfea3f9bc6f6c4abaf76555af89a9565dfc0853d99067be9042dd66ed6246696eecbb
-
memory/2176-0-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/2176-1-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/2176-2-0x0000000002080000-0x00000000020C0000-memory.dmpFilesize
256KB
-
memory/2176-3-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/2176-4-0x0000000002080000-0x00000000020C0000-memory.dmpFilesize
256KB
-
memory/2176-15-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/2560-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-19-0x0000000002200000-0x0000000002240000-memory.dmpFilesize
256KB
-
memory/2560-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-18-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2560-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2560-20-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2560-23-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2560-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-29-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2560-30-0x0000000002200000-0x0000000002240000-memory.dmpFilesize
256KB