Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
order432017.exe
Resource
win7-20240221-en
General
-
Target
order432017.exe
-
Size
2.8MB
-
MD5
964727c8e4fae448d46f90d655eb0858
-
SHA1
927cc815ed091edfd1f34641e0855418c91384be
-
SHA256
eb439cba780d8e342ea0cb729f3a44f559e94c1b05f68888baae089f1d8989e8
-
SHA512
34b3f588951bd47b8c375e1e4af5911d9a1cf9165634358944584d27dff76fa9bd66305d63db1291b0a2f6d938e1b35d6bd895afc5b7b86ad0a4c4f2e959caab
-
SSDEEP
49152:zXBVIAJ9qg3JDwbBkj0guEw+qEi9hBDpb7N:zXBVvJ05YRcfF
Malware Config
Extracted
nanocore
1.2.2.0
labibeautyparlour.ddns.net:6568
d06e713d-e6e9-46d5-8cf3-65a9d929c392
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-01-03T00:58:54.479094036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6568
-
default_group
Labi slaves
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
d06e713d-e6e9-46d5-8cf3-65a9d929c392
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
labibeautyparlour.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Invoice.EXEpid process 2480 Invoice.EXE -
Loads dropped DLL 3 IoCs
Processes:
installutil.exeinstallutil.exepid process 2784 installutil.exe 2368 installutil.exe 2368 installutil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
installutil.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Files = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Invoice.exe\"" installutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Host = "C:\\Program Files (x86)\\DHCP Host\\dhcphost.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
installutil.exedescription pid process target process PID 2368 set thread context of 2184 2368 installutil.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DHCP Host\dhcphost.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DHCP Host\dhcphost.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1600 schtasks.exe 2096 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 2184 RegAsm.exe 2184 RegAsm.exe 2184 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2184 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
installutil.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2784 installutil.exe Token: SeDebugPrivilege 2184 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
order432017.exeinstallutil.exeInvoice.EXEinstallutil.exedescription pid process target process PID 1756 wrote to memory of 1992 1756 order432017.exe cmd.exe PID 1756 wrote to memory of 1992 1756 order432017.exe cmd.exe PID 1756 wrote to memory of 1992 1756 order432017.exe cmd.exe PID 1756 wrote to memory of 1992 1756 order432017.exe cmd.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 1756 wrote to memory of 2784 1756 order432017.exe installutil.exe PID 2784 wrote to memory of 2612 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2612 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2612 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2612 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2452 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2452 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2452 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2452 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2460 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2460 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2460 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2460 2784 installutil.exe cmd.exe PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2784 wrote to memory of 2480 2784 installutil.exe Invoice.EXE PID 2480 wrote to memory of 2920 2480 Invoice.EXE cmd.exe PID 2480 wrote to memory of 2920 2480 Invoice.EXE cmd.exe PID 2480 wrote to memory of 2920 2480 Invoice.EXE cmd.exe PID 2480 wrote to memory of 2920 2480 Invoice.EXE cmd.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2480 wrote to memory of 2368 2480 Invoice.EXE installutil.exe PID 2368 wrote to memory of 1804 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 1804 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 1804 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 1804 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 328 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 328 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 328 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 328 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 320 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 320 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 320 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 320 2368 installutil.exe cmd.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe PID 2368 wrote to memory of 2184 2368 installutil.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order432017.exe"C:\Users\Admin\AppData\Local\Temp\order432017.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null2⤵PID:1992
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\order432017.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null3⤵PID:2612
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"3⤵PID:2452
-
C:\Windows\SysWOW64\cmd.execmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"3⤵PID:2460
-
C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXEC:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE":Zone.Identifier) 2 > Null4⤵PID:2920
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"4⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.exe":Zone.Identifier) 2 > Null5⤵PID:1804
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"5⤵PID:328
-
C:\Windows\SysWOW64\cmd.execmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"5⤵PID:320
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"5⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp22DC.tmp"6⤵
- Creates scheduled task(s)
PID:1600 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp231B.tmp"6⤵
- Creates scheduled task(s)
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
Filesize
1KB
MD50479d5f304ef2d7e3c15fb24a99f88c1
SHA18edbb1450a656fac5f5e96779ffe440ee8c1aec9
SHA256112557c2b2d0c669a3b115129dc32f005341e965330fa8f2ad3e5de1926594bc
SHA512537e8d87e5cd975f0e69bb145f81d6e9d7b0d82eed143ac351304ea38577137386a51fdb7357ec6d641eb04ff5f51e249bba2db8a4b5bf2934d561394a4a3f15
-
Filesize
2.8MB
MD5964727c8e4fae448d46f90d655eb0858
SHA1927cc815ed091edfd1f34641e0855418c91384be
SHA256eb439cba780d8e342ea0cb729f3a44f559e94c1b05f68888baae089f1d8989e8
SHA51234b3f588951bd47b8c375e1e4af5911d9a1cf9165634358944584d27dff76fa9bd66305d63db1291b0a2f6d938e1b35d6bd895afc5b7b86ad0a4c4f2e959caab