Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
ACH PAYMENT REMITTANCE.DOC.exe
Resource
win7-20240508-en
General
-
Target
ACH PAYMENT REMITTANCE.DOC.exe
-
Size
929KB
-
MD5
0e9543a317167346e764e54c9efcdca2
-
SHA1
8f35febea4eed47852be207eaa4851d22eeeb99d
-
SHA256
66772b771a09542f6e9f395a47f82e2b2ff7f9640d1889a57d311a0c4e32dfd9
-
SHA512
8c19846dd9cdf429780a717f0dc9c2fa13e2978241b37332e2bc620fc021c9bdd742007b7f05e4c1fb182fd1940108614ce61a73a855f608172d694c83bd52ad
-
SSDEEP
6144:MwlW5xVGa5kKdl+mBhCbq+wYaVriHWmE8m9jAa9xCRy2r4jGX5+D5vJ8o1IOyTXv:iDd4kmsJ6eCxzOCtq3yOs7g1JTiDFQoV
Malware Config
Extracted
nanocore
1.2.2.0
maquicantro.duckdns.org:54984
6615e4b6-140c-4fee-a706-7fe1189f7d99
-
activate_away_mode
true
-
backup_connection_host
maquicantro.duckdns.org
- backup_dns_server
-
buffer_size
65535
-
build_time
2018-07-30T20:24:40.443351736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
MINO
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6615e4b6-140c-4fee-a706-7fe1189f7d99
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
maquicantro.duckdns.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsv.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exedescription pid process target process PID 4724 set thread context of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DHCP Service\dhcpsv.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DHCP Service\dhcpsv.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3440 schtasks.exe 4076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exeRegAsm.exepid process 4724 ACH PAYMENT REMITTANCE.DOC.exe 4724 ACH PAYMENT REMITTANCE.DOC.exe 2512 RegAsm.exe 2512 RegAsm.exe 2512 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2512 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4724 ACH PAYMENT REMITTANCE.DOC.exe Token: SeDebugPrivilege 2512 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ACH PAYMENT REMITTANCE.DOC.exeRegAsm.exedescription pid process target process PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 4724 wrote to memory of 2512 4724 ACH PAYMENT REMITTANCE.DOC.exe RegAsm.exe PID 2512 wrote to memory of 3440 2512 RegAsm.exe schtasks.exe PID 2512 wrote to memory of 3440 2512 RegAsm.exe schtasks.exe PID 2512 wrote to memory of 3440 2512 RegAsm.exe schtasks.exe PID 2512 wrote to memory of 4076 2512 RegAsm.exe schtasks.exe PID 2512 wrote to memory of 4076 2512 RegAsm.exe schtasks.exe PID 2512 wrote to memory of 4076 2512 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT REMITTANCE.DOC.exe"C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT REMITTANCE.DOC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5350.tmp"3⤵
- Creates scheduled task(s)
PID:3440 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp53BE.tmp"3⤵
- Creates scheduled task(s)
PID:4076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5350.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\AppData\Local\Temp\tmp53BE.tmpFilesize
1KB
MD5a77c223a0fc492dccd6fb9975f7a8766
SHA15e813636ae9b8138d78919348a5da3a6e8bd74b5
SHA256589df7325d42409c50827600fedb240171ee4bdab85916474a37800c2382829e
SHA512315cea8fde3c594404f5d3c96c710af1214cff6d08ccdb40634a739e108ff810e02624735a2b8c3e3720157b4a55327f317c3c23c3a681b46b9ab0f19060f7c0
-
memory/2512-11-0x0000000075400000-0x00000000759B1000-memory.dmpFilesize
5.7MB
-
memory/2512-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2512-9-0x0000000075402000-0x0000000075403000-memory.dmpFilesize
4KB
-
memory/2512-10-0x0000000075400000-0x00000000759B1000-memory.dmpFilesize
5.7MB
-
memory/2512-19-0x0000000075402000-0x0000000075403000-memory.dmpFilesize
4KB
-
memory/2512-20-0x0000000075400000-0x00000000759B1000-memory.dmpFilesize
5.7MB
-
memory/2512-21-0x0000000075400000-0x00000000759B1000-memory.dmpFilesize
5.7MB
-
memory/4724-3-0x0000000005440000-0x000000000544C000-memory.dmpFilesize
48KB
-
memory/4724-5-0x0000000005460000-0x0000000005498000-memory.dmpFilesize
224KB
-
memory/4724-6-0x00000000055E0000-0x000000000567C000-memory.dmpFilesize
624KB
-
memory/4724-0-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/4724-2-0x0000000005400000-0x0000000005444000-memory.dmpFilesize
272KB
-
memory/4724-1-0x0000000000A40000-0x0000000000B16000-memory.dmpFilesize
856KB