Resubmissions

05-05-2024 08:30

240505-kebn1scc8t 10

05-05-2024 08:08

240505-j1xmyafa93 10

05-05-2024 08:03

240505-jx2sgsbg9v 10

05-05-2024 07:42

240505-jjm26sbd3z 10

05-05-2024 07:33

240505-jdzh1sed62 10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 08:03

General

  • Target

    https://mega.nz/file/jqxVWIQT#EcaGfUbysreSEyuzDiIu9RNSIk7rIGYTYiGugzjLoqE

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/jqxVWIQT#EcaGfUbysreSEyuzDiIu9RNSIk7rIGYTYiGugzjLoqE
    1⤵
      PID:3364
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4816 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
      1⤵
        PID:1612
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4892 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:4776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4732 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:3440
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=1328 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
            1⤵
              PID:3112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:3432
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=4904 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:3976
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
                  1⤵
                    PID:4508
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x504 0x304
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6236 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
                    1⤵
                      PID:608
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6212 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
                      1⤵
                        PID:1832
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6552 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
                        1⤵
                          PID:4272
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6792 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
                          1⤵
                            PID:3576
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=6976 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:2712
                            • C:\Users\Admin\Downloads\godhuntermode.exe
                              "C:\Users\Admin\Downloads\godhuntermode.exe"
                              1⤵
                              • Adds Run key to start application
                              • Drops file in Program Files directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1128
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDE45.tmp"
                                2⤵
                                • Creates scheduled task(s)
                                PID:1780
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /create /f /tn "SMTP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDF11.tmp"
                                2⤵
                                • Creates scheduled task(s)
                                PID:4956
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4628
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=5812 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
                              1⤵
                                PID:3912

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\tmpDE45.tmp

                                Filesize

                                1KB

                                MD5

                                27c110eeac8b064d06586616a32e5ccd

                                SHA1

                                c02635e49bb1bbc6a2966e0b7952fff0892d3cf1

                                SHA256

                                21ad204215b4be0d8900c4f8d19a58fc245db473b3d15101212899b8364d2294

                                SHA512

                                a6928600c976c1ccacfb98c80dd5479f40768100d638babd36da0efd1c34d4dbb7ca555b59d25a8713ad38cffbe7e4ead1c6731820286502a4c986cd93b15c7a

                              • C:\Users\Admin\AppData\Local\Temp\tmpDF11.tmp

                                Filesize

                                1KB

                                MD5

                                f4819a1db9e68dc60cf594a7262a3f4c

                                SHA1

                                105f1392b72f117e378e502436eafadac5d6eb95

                                SHA256

                                9648afd55d1ee72983b04b574bb1fa870549d3db91dafdd7a15e253858090f2a

                                SHA512

                                18a71e6ecd89ee2f8cb9d55abc0507acfddacc18c6fff9bbd2e891cf4b3dacad8e2a2bc5a76071d6539ab23b905b8e0e313806152795b9b3a20882d90f6cfa2a

                              • memory/1128-29-0x000000001DAA0000-0x000000001DAAE000-memory.dmp

                                Filesize

                                56KB

                              • memory/1128-1-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-4-0x000000001BF70000-0x000000001C00C000-memory.dmp

                                Filesize

                                624KB

                              • memory/1128-28-0x000000001DA90000-0x000000001DA9C000-memory.dmp

                                Filesize

                                48KB

                              • memory/1128-6-0x0000000000E40000-0x0000000000E48000-memory.dmp

                                Filesize

                                32KB

                              • memory/1128-31-0x0000000000E60000-0x0000000000E70000-memory.dmp

                                Filesize

                                64KB

                              • memory/1128-2-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-27-0x000000001DA80000-0x000000001DA92000-memory.dmp

                                Filesize

                                72KB

                              • memory/1128-15-0x000000001CAD0000-0x000000001CADA000-memory.dmp

                                Filesize

                                40KB

                              • memory/1128-16-0x000000001CA50000-0x000000001CA6E000-memory.dmp

                                Filesize

                                120KB

                              • memory/1128-17-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-18-0x000000001B5A0000-0x000000001B5AA000-memory.dmp

                                Filesize

                                40KB

                              • memory/1128-19-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-20-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-21-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-24-0x0000000000E30000-0x0000000000E42000-memory.dmp

                                Filesize

                                72KB

                              • memory/1128-25-0x000000001CD60000-0x000000001CD7A000-memory.dmp

                                Filesize

                                104KB

                              • memory/1128-26-0x000000001B590000-0x000000001B59E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1128-0-0x00007FF8A1115000-0x00007FF8A1116000-memory.dmp

                                Filesize

                                4KB

                              • memory/1128-30-0x000000001DAB0000-0x000000001DAC4000-memory.dmp

                                Filesize

                                80KB

                              • memory/1128-5-0x000000001C1C0000-0x000000001C266000-memory.dmp

                                Filesize

                                664KB

                              • memory/1128-3-0x000000001BAA0000-0x000000001BF6E000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1128-7-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-32-0x00000000010D0000-0x00000000010E4000-memory.dmp

                                Filesize

                                80KB

                              • memory/1128-33-0x000000001B580000-0x000000001B58E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1128-34-0x000000001DAC0000-0x000000001DAEE000-memory.dmp

                                Filesize

                                184KB

                              • memory/1128-35-0x000000001CEC0000-0x000000001CED4000-memory.dmp

                                Filesize

                                80KB

                              • memory/1128-36-0x000000001DBC0000-0x000000001DC22000-memory.dmp

                                Filesize

                                392KB

                              • memory/1128-38-0x00007FF8A1115000-0x00007FF8A1116000-memory.dmp

                                Filesize

                                4KB

                              • memory/1128-39-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-40-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-41-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-42-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-43-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-44-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-45-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-46-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/1128-57-0x000000001EFE0000-0x000000001F737000-memory.dmp

                                Filesize

                                7.3MB

                              • memory/1128-70-0x0000000022150000-0x00000000228F6000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/1128-213-0x000000001EFE0000-0x000000001F737000-memory.dmp

                                Filesize

                                7.3MB

                              • memory/1128-215-0x00007FF8A0E60000-0x00007FF8A1801000-memory.dmp

                                Filesize

                                9.6MB