Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 23:50
Static task
static1
Behavioral task
behavioral1
Sample
1216242020.exe
Resource
win7-20240220-en
General
-
Target
1216242020.exe
-
Size
368KB
-
MD5
b26e02708c3c9af220b62324c7dfd051
-
SHA1
b0e11425eab3a005fca2e595f2ce80d39aaeb58a
-
SHA256
8f88c71422c2790790dd50c3ff89fe3a5add4e1d55a83e50d6b445779d813796
-
SHA512
ac9c710e493fba14056a9042f160e178dd7940c922d336109efe4f8aadc42a58da6f316a2e4ddd627852b750d52d25d2329962fdff16ff39099eabcd00a8f674
-
SSDEEP
6144:A43+hdkseMXAtY96fHVo3XMmtWIkXb1QRosnE76JH9Ew9l0BqmLzAvq9z:fhMXAtY96/9HIkXmRdE76JH9Xl0BqBvM
Malware Config
Extracted
nanocore
1.2.2.0
wazzy.ddns.net:1716
194.5.99.24:1716
c1ffd46d-254d-4433-8da6-7277dec7b59a
-
activate_away_mode
true
-
backup_connection_host
194.5.99.24
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-28T11:57:28.371938436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1716
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c1ffd46d-254d-4433-8da6-7277dec7b59a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
wazzy.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1216242020.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 1216242020.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1216242020.exedescription pid process target process PID 4476 set thread context of 3692 4476 1216242020.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3428 schtasks.exe 1084 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
1216242020.exeMSBuild.exepid process 4476 1216242020.exe 4476 1216242020.exe 4476 1216242020.exe 4476 1216242020.exe 3692 MSBuild.exe 3692 MSBuild.exe 3692 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 3692 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1216242020.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 4476 1216242020.exe Token: SeDebugPrivilege 3692 MSBuild.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1216242020.exeMSBuild.exedescription pid process target process PID 4476 wrote to memory of 3428 4476 1216242020.exe schtasks.exe PID 4476 wrote to memory of 3428 4476 1216242020.exe schtasks.exe PID 4476 wrote to memory of 3428 4476 1216242020.exe schtasks.exe PID 4476 wrote to memory of 3864 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3864 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3864 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3592 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3592 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3592 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 4476 wrote to memory of 3692 4476 1216242020.exe MSBuild.exe PID 3692 wrote to memory of 1084 3692 MSBuild.exe schtasks.exe PID 3692 wrote to memory of 1084 3692 MSBuild.exe schtasks.exe PID 3692 wrote to memory of 1084 3692 MSBuild.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1216242020.exe"C:\Users\Admin\AppData\Local\Temp\1216242020.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BTGAGCgDGBVI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA7F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEF03.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEA7F.tmpFilesize
1KB
MD5ddd331a5302312b080f347bd51dded48
SHA1e9f5d3728872dd3450188562a5bc161797abb3b5
SHA256cc30ab5cf91f246cd21998b4356e059dcc5826b000e37c05fff5c7915a23346e
SHA512610efc937eb7afe988c43c6765c9b8c4ea66b9b1ef70b2beb3791cab5b0e154e00f05e80d602656f6d54aa8661906dc08962699fd769c8f504c28d629d4d4fcb
-
C:\Users\Admin\AppData\Local\Temp\tmpEF03.tmpFilesize
1KB
MD5ae766004c0d8792953bafffe8f6a2e3b
SHA114b12f27543a401e2fe0af8052e116cab0032426
SHA2561abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540
SHA512e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567
-
memory/3692-15-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/3692-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3692-14-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/3692-20-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/3692-21-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/3692-22-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/4476-3-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/4476-4-0x0000000074E72000-0x0000000074E73000-memory.dmpFilesize
4KB
-
memory/4476-5-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/4476-2-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/4476-0-0x0000000074E72000-0x0000000074E73000-memory.dmpFilesize
4KB
-
memory/4476-13-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/4476-1-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB