Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
order432017.exe
Resource
win7-20240221-en
General
-
Target
order432017.exe
-
Size
2.8MB
-
MD5
964727c8e4fae448d46f90d655eb0858
-
SHA1
927cc815ed091edfd1f34641e0855418c91384be
-
SHA256
eb439cba780d8e342ea0cb729f3a44f559e94c1b05f68888baae089f1d8989e8
-
SHA512
34b3f588951bd47b8c375e1e4af5911d9a1cf9165634358944584d27dff76fa9bd66305d63db1291b0a2f6d938e1b35d6bd895afc5b7b86ad0a4c4f2e959caab
-
SSDEEP
49152:zXBVIAJ9qg3JDwbBkj0guEw+qEi9hBDpb7N:zXBVvJ05YRcfF
Malware Config
Extracted
nanocore
1.2.2.0
labibeautyparlour.ddns.net:6568
d06e713d-e6e9-46d5-8cf3-65a9d929c392
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-01-03T00:58:54.479094036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6568
-
default_group
Labi slaves
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
d06e713d-e6e9-46d5-8cf3-65a9d929c392
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
labibeautyparlour.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
order432017.exeInvoice.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation order432017.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Invoice.EXE -
Executes dropped EXE 1 IoCs
Processes:
Invoice.EXEpid process 1820 Invoice.EXE -
Loads dropped DLL 2 IoCs
Processes:
installutil.exepid process 3820 installutil.exe 3820 installutil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
installutil.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Files = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Invoice.exe\"" installutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
order432017.exedescription ioc process File created C:\Windows\assembly\Desktop.ini order432017.exe File opened for modification C:\Windows\assembly\Desktop.ini order432017.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
installutil.exedescription pid process target process PID 3820 set thread context of 976 3820 installutil.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DPI Service\dpisvc.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DPI Service\dpisvc.exe RegAsm.exe -
Drops file in Windows directory 3 IoCs
Processes:
order432017.exedescription ioc process File opened for modification C:\Windows\assembly\Desktop.ini order432017.exe File opened for modification C:\Windows\assembly order432017.exe File created C:\Windows\assembly\Desktop.ini order432017.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4460 schtasks.exe 3964 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
installutil.exeRegAsm.exepid process 3820 installutil.exe 3820 installutil.exe 976 RegAsm.exe 976 RegAsm.exe 976 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 976 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
installutil.exeinstallutil.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1680 installutil.exe Token: SeDebugPrivilege 3820 installutil.exe Token: SeDebugPrivilege 976 RegAsm.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
order432017.exeinstallutil.exeInvoice.EXEinstallutil.exeRegAsm.exedescription pid process target process PID 4504 wrote to memory of 4856 4504 order432017.exe cmd.exe PID 4504 wrote to memory of 4856 4504 order432017.exe cmd.exe PID 4504 wrote to memory of 4856 4504 order432017.exe cmd.exe PID 4504 wrote to memory of 1680 4504 order432017.exe installutil.exe PID 4504 wrote to memory of 1680 4504 order432017.exe installutil.exe PID 4504 wrote to memory of 1680 4504 order432017.exe installutil.exe PID 1680 wrote to memory of 1888 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 1888 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 1888 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 2856 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 2856 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 2856 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 4100 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 4100 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 4100 1680 installutil.exe cmd.exe PID 1680 wrote to memory of 1820 1680 installutil.exe Invoice.EXE PID 1680 wrote to memory of 1820 1680 installutil.exe Invoice.EXE PID 1680 wrote to memory of 1820 1680 installutil.exe Invoice.EXE PID 1820 wrote to memory of 5116 1820 Invoice.EXE cmd.exe PID 1820 wrote to memory of 5116 1820 Invoice.EXE cmd.exe PID 1820 wrote to memory of 5116 1820 Invoice.EXE cmd.exe PID 1820 wrote to memory of 3820 1820 Invoice.EXE installutil.exe PID 1820 wrote to memory of 3820 1820 Invoice.EXE installutil.exe PID 1820 wrote to memory of 3820 1820 Invoice.EXE installutil.exe PID 3820 wrote to memory of 4284 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 4284 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 4284 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 2824 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 2824 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 2824 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 3324 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 3324 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 3324 3820 installutil.exe cmd.exe PID 3820 wrote to memory of 948 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 948 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 948 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 3820 wrote to memory of 976 3820 installutil.exe RegAsm.exe PID 976 wrote to memory of 4460 976 RegAsm.exe schtasks.exe PID 976 wrote to memory of 4460 976 RegAsm.exe schtasks.exe PID 976 wrote to memory of 4460 976 RegAsm.exe schtasks.exe PID 976 wrote to memory of 3964 976 RegAsm.exe schtasks.exe PID 976 wrote to memory of 3964 976 RegAsm.exe schtasks.exe PID 976 wrote to memory of 3964 976 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order432017.exe"C:\Users\Admin\AppData\Local\Temp\order432017.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null2⤵PID:4856
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\order432017.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null3⤵PID:1888
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"3⤵PID:2856
-
C:\Windows\SysWOW64\cmd.execmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"3⤵PID:4100
-
C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXEC:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE":Zone.Identifier) 2 > Null4⤵PID:5116
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"4⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.execmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.exe":Zone.Identifier) 2 > Null5⤵PID:4284
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"5⤵PID:2824
-
C:\Windows\SysWOW64\cmd.execmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"5⤵PID:3324
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"5⤵PID:948
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"5⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp30CF.tmp"6⤵
- Creates scheduled task(s)
PID:4460 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp311E.tmp"6⤵
- Creates scheduled task(s)
PID:3964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
Filesize
1KB
MD50d6d94a917c4ce63da6bc50cbbe0dc5d
SHA1599564f60649f3f4c14478e9cb184000d4280a61
SHA256e82a4b8311319f1b68cb06ae5b670e97a11c467b1bdb0ebf130f523bf98ca522
SHA51223ac6a088e2a1df3d75d2aca17cdcc5a4147b966758e4acc4d904293f4693f362db637d8135edd670e158bec77e788e915f2a55042a2f1aec09a4679bc749412
-
Filesize
2.8MB
MD5964727c8e4fae448d46f90d655eb0858
SHA1927cc815ed091edfd1f34641e0855418c91384be
SHA256eb439cba780d8e342ea0cb729f3a44f559e94c1b05f68888baae089f1d8989e8
SHA51234b3f588951bd47b8c375e1e4af5911d9a1cf9165634358944584d27dff76fa9bd66305d63db1291b0a2f6d938e1b35d6bd895afc5b7b86ad0a4c4f2e959caab