Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 20:43
Static task
static1
Behavioral task
behavioral1
Sample
2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe
Resource
win7-20240221-en
General
-
Target
2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe
-
Size
278KB
-
MD5
895c7f902ad22572547471476f2d4752
-
SHA1
25c06ae39f12241936491492966c083bb0a5548e
-
SHA256
2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7
-
SHA512
1361113e4f6248957240fb35df837c3b904dfaf9fda9c7afca10f1783319054f67285a7769c03a46bcf25f4d2a6f5940457b3c54a073f8386f820b86aa99923e
-
SSDEEP
6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKY:boSeGUA5YZazpXUmZhZ6SY
Malware Config
Extracted
nanocore
1.2.2.0
sysupdate24.ddns.net:45400
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2020-04-24T17:41:53.492468936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
45400
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sysupdate24.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe -
Executes dropped EXE 2 IoCs
Processes:
a1punf5t2of.exea1punf5t2of.exepid process 452 a1punf5t2of.exe 1648 a1punf5t2of.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" 2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe -
Processes:
a1punf5t2of.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1punf5t2of.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1punf5t2of.exedescription pid process target process PID 452 set thread context of 1648 452 a1punf5t2of.exe a1punf5t2of.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
a1punf5t2of.exepid process 1648 a1punf5t2of.exe 1648 a1punf5t2of.exe 1648 a1punf5t2of.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a1punf5t2of.exepid process 1648 a1punf5t2of.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1punf5t2of.exedescription pid process Token: SeDebugPrivilege 1648 a1punf5t2of.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exea1punf5t2of.exedescription pid process target process PID 1116 wrote to memory of 452 1116 2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe a1punf5t2of.exe PID 1116 wrote to memory of 452 1116 2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe a1punf5t2of.exe PID 1116 wrote to memory of 452 1116 2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe PID 452 wrote to memory of 1648 452 a1punf5t2of.exe a1punf5t2of.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe"C:\Users\Admin\AppData\Local\Temp\2f777e82b65e659254dfd9995d1009dea0d5fa999fa73121b9490fdc3c7505d7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exeFilesize
279KB
MD530d0c2b8fc7b63de0818e1ebf7aace31
SHA1d204d427f2ce08bc61fad989e7edfc8d3bdda70c
SHA2569974ac9f10f8acdec3571f99b4d77451a7659af44a26f22cd1fcf2393328c6a1
SHA51296f834b418d69add29d97ea3696767825dcc4653009976dcf1096dc07dd4fef7046f42f09f7ae7442eeb6b05c056c5da30f152d7f63b46950fe42a6c0a9edd2b
-
memory/452-31-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/452-17-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/452-19-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/452-20-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/452-33-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1116-1-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1116-2-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1116-3-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1116-18-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1116-0-0x0000000075132000-0x0000000075133000-memory.dmpFilesize
4KB
-
memory/1648-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1648-26-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1648-27-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1648-28-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1648-30-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1648-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1648-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1648-34-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB
-
memory/1648-35-0x0000000075130000-0x00000000756E1000-memory.dmpFilesize
5.7MB