Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 09:31
Static task
static1
Behavioral task
behavioral1
Sample
virussign.com_ec03c8da575fa5ee4745506b340968e.exe
Resource
win7-20240221-en
General
-
Target
virussign.com_ec03c8da575fa5ee4745506b340968e.exe
-
Size
296KB
-
MD5
ec03c8da575fa5ee4745506b340968e6
-
SHA1
357374aa9b28d6571ebcf3b535b3cd8fe85eebba
-
SHA256
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
-
SHA512
2d01fa27ef375f77db7e3a896877db902ea52578aaa13aaec2aef3ce8a0199b1de56ca70602bac24f4fd2278ed5835e2c373c0626a05e95929deb93abb94137a
-
SSDEEP
6144:ou+rdxKERB7nPpuU8Dh1tUS/fqLaiU6xVB3Y8TTp6VmSyp7jk:gdxK8B7nAU87tabNNTd6VnypU
Malware Config
Extracted
nanocore
1.2.2.0
munan.duckdns.org:3637
munabc.duckdns.org:3637
4d5a1bc9-ba60-4ed4-85d1-96a1836c92b0
-
activate_away_mode
true
-
backup_connection_host
munabc.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-09-24T00:04:44.813706136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3637
-
default_group
MUNA
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4d5a1bc9-ba60-4ed4-85d1-96a1836c92b0
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
munan.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
DDfiles.exeDDfiles.exepid process 4936 DDfiles.exe 4116 DDfiles.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
virussign.com_ec03c8da575fa5ee4745506b340968e.exeDDfiles.exeDDfiles.exedescription pid process target process PID 2300 set thread context of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 4936 set thread context of 4992 4936 DDfiles.exe RegAsm.exe PID 4116 set thread context of 5056 4116 DDfiles.exe RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 904 schtasks.exe 1768 schtasks.exe 1640 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 4444 RegAsm.exe 4444 RegAsm.exe 4444 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 4444 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 4444 RegAsm.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
virussign.com_ec03c8da575fa5ee4745506b340968e.execmd.exeDDfiles.execmd.exeDDfiles.execmd.exedescription pid process target process PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4444 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe RegAsm.exe PID 2300 wrote to memory of 4788 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 4788 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 4788 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 2124 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 2124 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 2124 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 1436 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 1436 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2300 wrote to memory of 1436 2300 virussign.com_ec03c8da575fa5ee4745506b340968e.exe cmd.exe PID 2124 wrote to memory of 904 2124 cmd.exe schtasks.exe PID 2124 wrote to memory of 904 2124 cmd.exe schtasks.exe PID 2124 wrote to memory of 904 2124 cmd.exe schtasks.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 4992 4936 DDfiles.exe RegAsm.exe PID 4936 wrote to memory of 2952 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 2952 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 2952 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 4580 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 4580 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 4580 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 2188 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 2188 4936 DDfiles.exe cmd.exe PID 4936 wrote to memory of 2188 4936 DDfiles.exe cmd.exe PID 4580 wrote to memory of 1768 4580 cmd.exe schtasks.exe PID 4580 wrote to memory of 1768 4580 cmd.exe schtasks.exe PID 4580 wrote to memory of 1768 4580 cmd.exe schtasks.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 5056 4116 DDfiles.exe RegAsm.exe PID 4116 wrote to memory of 4364 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 4364 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 4364 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 3184 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 3184 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 3184 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 4324 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 4324 4116 DDfiles.exe cmd.exe PID 4116 wrote to memory of 4324 4116 DDfiles.exe cmd.exe PID 3184 wrote to memory of 1640 3184 cmd.exe schtasks.exe PID 3184 wrote to memory of 1640 3184 cmd.exe schtasks.exe PID 3184 wrote to memory of 1640 3184 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_ec03c8da575fa5ee4745506b340968e.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_ec03c8da575fa5ee4745506b340968e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\virussign.com_ec03c8da575fa5ee4745506b340968e.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DDfiles.exe.logFilesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeFilesize
296KB
MD5ec03c8da575fa5ee4745506b340968e6
SHA1357374aa9b28d6571ebcf3b535b3cd8fe85eebba
SHA25626321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
SHA5122d01fa27ef375f77db7e3a896877db902ea52578aaa13aaec2aef3ce8a0199b1de56ca70602bac24f4fd2278ed5835e2c373c0626a05e95929deb93abb94137a
-
memory/2300-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmpFilesize
4KB
-
memory/2300-1-0x00000000003A0000-0x00000000003F0000-memory.dmpFilesize
320KB
-
memory/2300-2-0x0000000005140000-0x00000000056E4000-memory.dmpFilesize
5.6MB
-
memory/2300-3-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/2300-8-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/4444-9-0x0000000005230000-0x00000000052CC000-memory.dmpFilesize
624KB
-
memory/4444-12-0x0000000005140000-0x000000000514A000-memory.dmpFilesize
40KB
-
memory/4444-14-0x0000000005480000-0x000000000548A000-memory.dmpFilesize
40KB
-
memory/4444-15-0x0000000005EC0000-0x0000000005ECC000-memory.dmpFilesize
48KB
-
memory/4444-16-0x0000000005ED0000-0x0000000005EEE000-memory.dmpFilesize
120KB
-
memory/4444-17-0x0000000005F10000-0x0000000005F1A000-memory.dmpFilesize
40KB
-
memory/4444-18-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/4444-7-0x0000000005190000-0x0000000005222000-memory.dmpFilesize
584KB
-
memory/4444-6-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/4444-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB