Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
ACH PAYMENT REMITTANCE.DOC.exe
Resource
win7-20240508-en
General
-
Target
ACH PAYMENT REMITTANCE.DOC.exe
-
Size
929KB
-
MD5
0e9543a317167346e764e54c9efcdca2
-
SHA1
8f35febea4eed47852be207eaa4851d22eeeb99d
-
SHA256
66772b771a09542f6e9f395a47f82e2b2ff7f9640d1889a57d311a0c4e32dfd9
-
SHA512
8c19846dd9cdf429780a717f0dc9c2fa13e2978241b37332e2bc620fc021c9bdd742007b7f05e4c1fb182fd1940108614ce61a73a855f608172d694c83bd52ad
-
SSDEEP
6144:MwlW5xVGa5kKdl+mBhCbq+wYaVriHWmE8m9jAa9xCRy2r4jGX5+D5vJ8o1IOyTXv:iDd4kmsJ6eCxzOCtq3yOs7g1JTiDFQoV
Malware Config
Extracted
nanocore
1.2.2.0
maquicantro.duckdns.org:54984
6615e4b6-140c-4fee-a706-7fe1189f7d99
-
activate_away_mode
true
-
backup_connection_host
maquicantro.duckdns.org
- backup_dns_server
-
buffer_size
65535
-
build_time
2018-07-30T20:24:40.443351736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
MINO
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6615e4b6-140c-4fee-a706-7fe1189f7d99
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
maquicantro.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Service = "C:\\Program Files (x86)\\LAN Service\\lansv.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exedescription pid process target process PID 2716 set thread context of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\LAN Service\lansv.exe RegAsm.exe File opened for modification C:\Program Files (x86)\LAN Service\lansv.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2668 schtasks.exe 2056 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exeRegAsm.exepid process 2716 ACH PAYMENT REMITTANCE.DOC.exe 2716 ACH PAYMENT REMITTANCE.DOC.exe 3044 RegAsm.exe 3044 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 3044 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2716 ACH PAYMENT REMITTANCE.DOC.exe Token: SeDebugPrivilege 3044 RegAsm.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exeRegAsm.exedescription pid process target process PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2716 wrote to memory of 3044 2716 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 3044 wrote to memory of 2668 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2668 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2668 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2668 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2056 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2056 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2056 3044 RegAsm.exe schtasks.exe PID 3044 wrote to memory of 2056 3044 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT REMITTANCE.DOC.exe"C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT REMITTANCE.DOC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1A06.tmp"3⤵
- Creates scheduled task(s)
PID:2668 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1AC2.tmp"3⤵
- Creates scheduled task(s)
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1A06.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\AppData\Local\Temp\tmp1AC2.tmpFilesize
1KB
MD56b30dba7972c92c9a1b881e88c108b15
SHA1f76207985cc5a1f70edb2fb5bd45678f195a4564
SHA256578f5b0ff051f02f8e0a67fc3424dad554fa9489875475ea624fbb63eabfcbf7
SHA512e3dd368937f863cb07453de12173580fb63b8d3983db7119c24860f227c89ded76401c47607f5b1134d215d46fe2b40d4bc3d7299374f1e8abecdeaefc7b9099
-
memory/2716-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmpFilesize
4KB
-
memory/2716-1-0x0000000000210000-0x00000000002E6000-memory.dmpFilesize
856KB
-
memory/2716-2-0x00000000003D0000-0x0000000000414000-memory.dmpFilesize
272KB
-
memory/2716-3-0x0000000000630000-0x000000000063C000-memory.dmpFilesize
48KB
-
memory/2716-5-0x0000000000650000-0x0000000000688000-memory.dmpFilesize
224KB
-
memory/3044-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3044-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-21-0x0000000074C30000-0x00000000751DB000-memory.dmpFilesize
5.7MB
-
memory/3044-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-29-0x0000000074C30000-0x00000000751DB000-memory.dmpFilesize
5.7MB