Analysis
-
max time kernel
118s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
MB263350411AE.exe
Resource
win7-20231129-en
General
-
Target
MB263350411AE.exe
-
Size
626KB
-
MD5
e2196865b5bf76a88e29aca44bf3d2be
-
SHA1
a9b8f4e43508a4b22d937fb7c311fc74073e8f9c
-
SHA256
88cb52ac93a1552b61addb60481cacb4fbf6dee7f8d307ff87009e38b8e30088
-
SHA512
3cdfaa47b6d5d2a7e833a964b5af13b33b8d49f1faae0fe07a352d534c22e71a1a359d2f826cb1a133fd9c1a0e3a92cf3dc65544ae1f37b0eba792cd1b6dbc49
-
SSDEEP
12288:nlYifTETxUhUON64V5m6xYFF8r6VXjgupuMb:miQTGhU26a5m6uv8rpupu
Malware Config
Extracted
nanocore
1.2.2.0
xpwarzonlin2.ddns.net:1996
ca9f3160-72cd-488b-b81c-36547a098a95
-
activate_away_mode
true
-
backup_connection_host
xpwarzonlin2.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-03-01T13:08:23.726574636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1996
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ca9f3160-72cd-488b-b81c-36547a098a95
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
xpwarzonlin2.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MB263350411AE.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" MB263350411AE.exe -
Processes:
MB263350411AE.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MB263350411AE.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MB263350411AE.exedescription pid process target process PID 3060 set thread context of 2988 3060 MB263350411AE.exe MB263350411AE.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MB263350411AE.exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsv.exe MB263350411AE.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe MB263350411AE.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2588 schtasks.exe 2632 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
MB263350411AE.exepid process 2988 MB263350411AE.exe 2988 MB263350411AE.exe 2988 MB263350411AE.exe 2988 MB263350411AE.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MB263350411AE.exepid process 2988 MB263350411AE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MB263350411AE.exedescription pid process Token: SeDebugPrivilege 2988 MB263350411AE.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
MB263350411AE.exeMB263350411AE.exedescription pid process target process PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 3060 wrote to memory of 2988 3060 MB263350411AE.exe MB263350411AE.exe PID 2988 wrote to memory of 2588 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2588 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2588 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2588 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2632 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2632 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2632 2988 MB263350411AE.exe schtasks.exe PID 2988 wrote to memory of 2632 2988 MB263350411AE.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4911.tmp"3⤵
- Creates scheduled task(s)
PID:2588 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4A2B.tmp"3⤵
- Creates scheduled task(s)
PID:2632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4911.tmpFilesize
1KB
MD57c43147ac70e592d3acc3e6a27111053
SHA153748eb6ebe48adbd036a6ba50bbcaaec652679e
SHA25623cab1d670839621ad7bf4d674ec424692d8c35f5a377ee8ff8860f64a920f7f
SHA512e3c480ef85d8cf7f1f5239b93f69202fd95efc3852cf9e1d69555abb17f7fab2f213626af564507cc55c0f573587ebd1137e099b859df7cfee7a37b9326bcf63
-
C:\Users\Admin\AppData\Local\Temp\tmp4A2B.tmpFilesize
1KB
MD593fc3117767507c9889abd12dc667d22
SHA11096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA256684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
SHA512e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc
-
memory/2988-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-41-0x00000000009B0000-0x00000000009BC000-memory.dmpFilesize
48KB
-
memory/2988-50-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2988-49-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2988-47-0x0000000002320000-0x0000000002334000-memory.dmpFilesize
80KB
-
memory/2988-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-31-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/2988-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2988-32-0x0000000000450000-0x000000000046E000-memory.dmpFilesize
120KB
-
memory/2988-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-21-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2988-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-22-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2988-46-0x0000000004430000-0x000000000445E000-memory.dmpFilesize
184KB
-
memory/2988-45-0x00000000021C0000-0x00000000021CE000-memory.dmpFilesize
56KB
-
memory/2988-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-44-0x0000000000A90000-0x0000000000AA4000-memory.dmpFilesize
80KB
-
memory/2988-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2988-33-0x00000000004B0000-0x00000000004BA000-memory.dmpFilesize
40KB
-
memory/2988-36-0x00000000005E0000-0x00000000005F2000-memory.dmpFilesize
72KB
-
memory/2988-37-0x00000000005F0000-0x000000000060A000-memory.dmpFilesize
104KB
-
memory/2988-38-0x00000000006A0000-0x00000000006AE000-memory.dmpFilesize
56KB
-
memory/2988-40-0x00000000009A0000-0x00000000009AE000-memory.dmpFilesize
56KB
-
memory/2988-39-0x0000000000700000-0x0000000000712000-memory.dmpFilesize
72KB
-
memory/2988-43-0x0000000000A80000-0x0000000000A90000-memory.dmpFilesize
64KB
-
memory/2988-42-0x0000000000A70000-0x0000000000A84000-memory.dmpFilesize
80KB
-
memory/3060-3-0x0000000000700000-0x000000000071A000-memory.dmpFilesize
104KB
-
memory/3060-0-0x000000007498E000-0x000000007498F000-memory.dmpFilesize
4KB
-
memory/3060-2-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/3060-23-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/3060-1-0x0000000000AA0000-0x0000000000B42000-memory.dmpFilesize
648KB
-
memory/3060-5-0x0000000004950000-0x00000000049CA000-memory.dmpFilesize
488KB
-
memory/3060-4-0x00000000004D0000-0x00000000004E0000-memory.dmpFilesize
64KB