Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 01:43
Static task
static1
Behavioral task
behavioral1
Sample
MB263350411AE.exe
Resource
win7-20240221-en
General
-
Target
MB263350411AE.exe
-
Size
626KB
-
MD5
e2196865b5bf76a88e29aca44bf3d2be
-
SHA1
a9b8f4e43508a4b22d937fb7c311fc74073e8f9c
-
SHA256
88cb52ac93a1552b61addb60481cacb4fbf6dee7f8d307ff87009e38b8e30088
-
SHA512
3cdfaa47b6d5d2a7e833a964b5af13b33b8d49f1faae0fe07a352d534c22e71a1a359d2f826cb1a133fd9c1a0e3a92cf3dc65544ae1f37b0eba792cd1b6dbc49
-
SSDEEP
12288:nlYifTETxUhUON64V5m6xYFF8r6VXjgupuMb:miQTGhU26a5m6uv8rpupu
Malware Config
Extracted
nanocore
1.2.2.0
xpwarzonlin2.ddns.net:1996
ca9f3160-72cd-488b-b81c-36547a098a95
-
activate_away_mode
true
-
backup_connection_host
xpwarzonlin2.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-03-01T13:08:23.726574636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1996
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ca9f3160-72cd-488b-b81c-36547a098a95
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
xpwarzonlin2.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MB263350411AE.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsv.exe" MB263350411AE.exe -
Processes:
MB263350411AE.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MB263350411AE.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MB263350411AE.exedescription pid process target process PID 1124 set thread context of 4212 1124 MB263350411AE.exe MB263350411AE.exe -
Drops file in Program Files directory 2 IoCs
Processes:
MB263350411AE.exedescription ioc process File opened for modification C:\Program Files (x86)\DHCP Service\dhcpsv.exe MB263350411AE.exe File created C:\Program Files (x86)\DHCP Service\dhcpsv.exe MB263350411AE.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5760 schtasks.exe 2080 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
MB263350411AE.exepid process 4212 MB263350411AE.exe 4212 MB263350411AE.exe 4212 MB263350411AE.exe 4212 MB263350411AE.exe 4212 MB263350411AE.exe 4212 MB263350411AE.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MB263350411AE.exepid process 4212 MB263350411AE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MB263350411AE.exedescription pid process Token: SeDebugPrivilege 4212 MB263350411AE.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
MB263350411AE.exeMB263350411AE.exedescription pid process target process PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 1124 wrote to memory of 4212 1124 MB263350411AE.exe MB263350411AE.exe PID 4212 wrote to memory of 2080 4212 MB263350411AE.exe schtasks.exe PID 4212 wrote to memory of 2080 4212 MB263350411AE.exe schtasks.exe PID 4212 wrote to memory of 2080 4212 MB263350411AE.exe schtasks.exe PID 4212 wrote to memory of 5760 4212 MB263350411AE.exe schtasks.exe PID 4212 wrote to memory of 5760 4212 MB263350411AE.exe schtasks.exe PID 4212 wrote to memory of 5760 4212 MB263350411AE.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"C:\Users\Admin\AppData\Local\Temp\MB263350411AE.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7705.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7754.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MB263350411AE.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\tmp7705.tmpFilesize
1KB
MD57c43147ac70e592d3acc3e6a27111053
SHA153748eb6ebe48adbd036a6ba50bbcaaec652679e
SHA25623cab1d670839621ad7bf4d674ec424692d8c35f5a377ee8ff8860f64a920f7f
SHA512e3c480ef85d8cf7f1f5239b93f69202fd95efc3852cf9e1d69555abb17f7fab2f213626af564507cc55c0f573587ebd1137e099b859df7cfee7a37b9326bcf63
-
C:\Users\Admin\AppData\Local\Temp\tmp7754.tmpFilesize
1KB
MD5a77c223a0fc492dccd6fb9975f7a8766
SHA15e813636ae9b8138d78919348a5da3a6e8bd74b5
SHA256589df7325d42409c50827600fedb240171ee4bdab85916474a37800c2382829e
SHA512315cea8fde3c594404f5d3c96c710af1214cff6d08ccdb40634a739e108ff810e02624735a2b8c3e3720157b4a55327f317c3c23c3a681b46b9ab0f19060f7c0
-
memory/1124-8-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB
-
memory/1124-2-0x0000000005350000-0x00000000058F4000-memory.dmpFilesize
5.6MB
-
memory/1124-4-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/1124-6-0x0000000005000000-0x000000000509C000-memory.dmpFilesize
624KB
-
memory/1124-7-0x0000000006470000-0x000000000648A000-memory.dmpFilesize
104KB
-
memory/1124-0-0x000000007486E000-0x000000007486F000-memory.dmpFilesize
4KB
-
memory/1124-9-0x00000000062D0000-0x000000000634A000-memory.dmpFilesize
488KB
-
memory/1124-5-0x0000000004D60000-0x0000000004D6A000-memory.dmpFilesize
40KB
-
memory/1124-3-0x0000000004DA0000-0x0000000004E32000-memory.dmpFilesize
584KB
-
memory/1124-1-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1124-14-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/4212-40-0x0000000006E20000-0x0000000006E86000-memory.dmpFilesize
408KB
-
memory/4212-34-0x0000000006BB0000-0x0000000006BC4000-memory.dmpFilesize
80KB
-
memory/4212-13-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/4212-43-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/4212-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4212-25-0x00000000063D0000-0x00000000063DA000-memory.dmpFilesize
40KB
-
memory/4212-28-0x0000000006B30000-0x0000000006B42000-memory.dmpFilesize
72KB
-
memory/4212-29-0x0000000006B40000-0x0000000006B5A000-memory.dmpFilesize
104KB
-
memory/4212-30-0x0000000006B70000-0x0000000006B7E000-memory.dmpFilesize
56KB
-
memory/4212-33-0x0000000006BA0000-0x0000000006BAC000-memory.dmpFilesize
48KB
-
memory/4212-32-0x0000000006B90000-0x0000000006B9E000-memory.dmpFilesize
56KB
-
memory/4212-15-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/4212-31-0x0000000006B80000-0x0000000006B92000-memory.dmpFilesize
72KB
-
memory/4212-35-0x0000000006BC0000-0x0000000006BD0000-memory.dmpFilesize
64KB
-
memory/4212-36-0x0000000006BE0000-0x0000000006BF4000-memory.dmpFilesize
80KB
-
memory/4212-37-0x0000000006C00000-0x0000000006C0E000-memory.dmpFilesize
56KB
-
memory/4212-38-0x0000000006C10000-0x0000000006C3E000-memory.dmpFilesize
184KB
-
memory/4212-39-0x0000000006C50000-0x0000000006C64000-memory.dmpFilesize
80KB
-
memory/4212-24-0x00000000062A0000-0x00000000062BE000-memory.dmpFilesize
120KB
-
memory/4212-42-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/4212-23-0x00000000051B0000-0x00000000051BA000-memory.dmpFilesize
40KB