Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 09:20

General

  • Target

    PO-B1120017228.exe

  • Size

    256KB

  • MD5

    8c810e18058e24ff54a30a44e040569a

  • SHA1

    b0329f16013e786898cd75c101565fa70850be03

  • SHA256

    0e07d406f33fbf19219ea60e644cfd634fc8c934508bb608a6a1a3f13db1cc5a

  • SHA512

    f9beeaf52b85d01596382b2d5a64922332fea7f4894c24eeeae45ad07ba80cd70800a81e29f13922accc1d922b0ba56e8456a24bd03f0f1e51c623f2cc6726e1

  • SSDEEP

    6144:PZJR0bf1uc1p4wp/vNClO74ahHmJGhygfke7WLSaRnG:hiD1pR/Vv74aJygfkeSLv

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO-B1120017228.exe
    "C:\Users\Admin\AppData\Local\Temp\PO-B1120017228.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Drops desktop.ini file(s)
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon\winlogon.exe.lnk" /f
        3⤵
          PID:3252
      • C:\Users\Admin\AppData\Roaming\tmp.exe
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        2⤵
        • Executes dropped EXE
        PID:4580
      • C:\Users\Admin\AppData\Local\Temp\PO-B1120017228.exe
        "C:\Users\Admin\AppData\Local\Temp\PO-B1120017228.exe"
        2⤵
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6C95.tmp"
          3⤵
          • Creates scheduled task(s)
          PID:3492
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\winlogon\winlogon.exe.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 300
          3⤵
          • Delays execution with timeout.exe
          PID:4108

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp6C95.tmp

      Filesize

      1KB

      MD5

      e5cc560fef620b58811b19ec54168440

      SHA1

      a6d5d68e2009bb12ffd49c5251d26fe973f7e10f

      SHA256

      82da477cdf0dc2ed8197afd69d702e34240578250c233b489dfe5e8472f56b75

      SHA512

      64e5b751072bb0eea1b36dd6385be0b824e90db08fac384ce02f63a51b9a23ad7efd2ac7c71d5c2f1f2f7018c881335dae321ed96c821adca5d9b58ed6ec7bb6

    • C:\Users\Admin\AppData\Roaming\tmp.exe

      Filesize

      203KB

      MD5

      aee43daf7741caca297366c1b3847064

      SHA1

      1489823a4d9b9a1af0c0b68d4f9736b2e4e8760c

      SHA256

      86f69803a5ef3352b380deeb1f13a31ea64a284ef468aa383c18a362f0136533

      SHA512

      2ae87b23504e2fa2b5cf971c3aa90dd5169b7d867608e1ed03519545904bcf512a2798cd1efb2cd781a96e7e146ce346cd2470fb77fcf9a8633928fee31f7f15

    • C:\Users\Admin\AppData\Roaming\winlogon\winlogon.exe

      Filesize

      256KB

      MD5

      8c810e18058e24ff54a30a44e040569a

      SHA1

      b0329f16013e786898cd75c101565fa70850be03

      SHA256

      0e07d406f33fbf19219ea60e644cfd634fc8c934508bb608a6a1a3f13db1cc5a

      SHA512

      f9beeaf52b85d01596382b2d5a64922332fea7f4894c24eeeae45ad07ba80cd70800a81e29f13922accc1d922b0ba56e8456a24bd03f0f1e51c623f2cc6726e1

    • C:\Users\Admin\AppData\Roaming\winlogon\winlogon.exe.bat

      Filesize

      194B

      MD5

      a6a348e297488daf6ff46dfa30aae8b2

      SHA1

      df8d695405da71f61dc6640882ce942271ae5695

      SHA256

      877588837ba56aebb4e60e060f881401a081fdc852e6cdea71086d86b6f82daa

      SHA512

      82227ba2d19b6b8ee1fe0f4a034b1725a33fb524d53bc045c471da724798ccd2327173fb1b113056a31e09fd228059f6335050ceeb4c0f33f349b60caa49a3ba

    • memory/4268-1-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4268-2-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4268-0-0x00000000748D2000-0x00000000748D3000-memory.dmp

      Filesize

      4KB

    • memory/4268-43-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4268-39-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4268-38-0x00000000748D2000-0x00000000748D3000-memory.dmp

      Filesize

      4KB

    • memory/4324-21-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4324-25-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4324-22-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4324-44-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4324-45-0x00000000748D0000-0x0000000074E81000-memory.dmp

      Filesize

      5.7MB

    • memory/4580-32-0x000000001C6A0000-0x000000001C73C000-memory.dmp

      Filesize

      624KB

    • memory/4580-31-0x00007FFA93DB0000-0x00007FFA94751000-memory.dmp

      Filesize

      9.6MB

    • memory/4580-28-0x000000001C130000-0x000000001C5FE000-memory.dmp

      Filesize

      4.8MB

    • memory/4580-33-0x000000001C8F0000-0x000000001C996000-memory.dmp

      Filesize

      664KB

    • memory/4580-37-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

      Filesize

      32KB

    • memory/4580-26-0x0000000001510000-0x0000000001520000-memory.dmp

      Filesize

      64KB

    • memory/4580-27-0x00007FFA94065000-0x00007FFA94066000-memory.dmp

      Filesize

      4KB

    • memory/4580-41-0x00007FFA93DB0000-0x00007FFA94751000-memory.dmp

      Filesize

      9.6MB