Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 13:59
Static task
static1
Behavioral task
behavioral1
Sample
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe
Resource
win7-20240419-en
General
-
Target
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe
-
Size
1.1MB
-
MD5
c6df0f1fdf3b0d52580f6375537a144a
-
SHA1
639e22e5ace59d41e039c8e89131f69bc8da96e7
-
SHA256
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c
-
SHA512
ce8552ceea68a0c7e6bbef63fcbbe8ce6a2192bb4dfb96c74a93a13a059698fe31e2b42360183649d1dc9cc096441ae741ae98180634d9f588565437a8c1de8d
-
SSDEEP
24576:GAHnh+eWsN3skA4RV1Hom2KXMmHatdwFWWMX/5:hh+ZkldoPK8YatiFWWMh
Malware Config
Extracted
nanocore
1.2.2.0
zaragoza.ddns.net:6318
23bc2405-d53d-4763-a563-8ae141477f39
-
activate_away_mode
true
-
backup_connection_host
zaragoza.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-03-05T18:44:12.253319636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6318
-
default_group
BULKMONEY
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
23bc2405-d53d-4763-a563-8ae141477f39
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
zaragoza.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DOS Manager = "C:\\Program Files (x86)\\DOS Manager\\dosmgr.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exedescription pid process target process PID 1996 set thread context of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DOS Manager\dosmgr.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DOS Manager\dosmgr.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2772 schtasks.exe 2896 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2628 RegSvcs.exe 2628 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2628 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exepid process 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2628 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exepid process 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exepid process 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exeRegSvcs.exedescription pid process target process PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 1996 wrote to memory of 2628 1996 b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe RegSvcs.exe PID 2628 wrote to memory of 2772 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2772 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2772 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2772 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2896 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2896 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2896 2628 RegSvcs.exe schtasks.exe PID 2628 wrote to memory of 2896 2628 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe"C:\Users\Admin\AppData\Local\Temp\b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DOS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp121A.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DOS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp12A7.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp121A.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp12A7.tmpFilesize
1KB
MD58f5713b14cee3089852f6c8d2a7a7d57
SHA18bffbea05715c6434ad593cce8a2c737f80ff788
SHA256ab3ce102242c3144f87bcbfe83984a478821cd09e62c0e5211b2ab37dde02d2c
SHA51282bd2378c2d6bb34a1ad3f2d26bfea583fc8403691bed6668521ba3e8bc7bdbdf142f872ddbc8e5251550f47c9bbee4eb3d0d6096f80d85259082cf68a454c72
-
memory/1996-10-0x00000000000C0000-0x00000000000C4000-memory.dmpFilesize
16KB
-
memory/2628-18-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/2628-16-0x0000000074A51000-0x0000000074A52000-memory.dmpFilesize
4KB
-
memory/2628-17-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/2628-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2628-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2628-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2628-26-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/2628-27-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/2628-28-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/2628-29-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/2628-30-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB