Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 01:05
Static task
static1
Behavioral task
behavioral1
Sample
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe
Resource
win7-20240611-en
General
-
Target
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe
-
Size
296KB
-
MD5
ec03c8da575fa5ee4745506b340968e6
-
SHA1
357374aa9b28d6571ebcf3b535b3cd8fe85eebba
-
SHA256
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
-
SHA512
2d01fa27ef375f77db7e3a896877db902ea52578aaa13aaec2aef3ce8a0199b1de56ca70602bac24f4fd2278ed5835e2c373c0626a05e95929deb93abb94137a
-
SSDEEP
6144:ou+rdxKERB7nPpuU8Dh1tUS/fqLaiU6xVB3Y8TTp6VmSyp7jk:gdxK8B7nAU87tabNNTd6VnypU
Malware Config
Extracted
nanocore
1.2.2.0
munan.duckdns.org:3637
munabc.duckdns.org:3637
4d5a1bc9-ba60-4ed4-85d1-96a1836c92b0
-
activate_away_mode
true
-
backup_connection_host
munabc.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-09-24T00:04:44.813706136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3637
-
default_group
MUNA
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4d5a1bc9-ba60-4ed4-85d1-96a1836c92b0
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
munan.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Detects executables packed with SmartAssembly 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-1-0x0000000000850000-0x00000000008A0000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/2032-38-0x00000000010A0000-0x00000000010F0000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/1964-65-0x0000000000220000-0x0000000000270000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Executes dropped EXE 3 IoCs
Processes:
DDfiles.exeDDfiles.exeDDfiles.exepid process 2032 DDfiles.exe 2168 DDfiles.exe 1964 DDfiles.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exeDDfiles.exeDDfiles.exeDDfiles.exedescription pid process target process PID 2420 set thread context of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2032 set thread context of 648 2032 DDfiles.exe RegAsm.exe PID 2168 set thread context of 2508 2168 DDfiles.exe RegAsm.exe PID 1964 set thread context of 996 1964 DDfiles.exe RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 612 schtasks.exe 2156 schtasks.exe 2628 schtasks.exe 1920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegAsm.exepid process 3020 RegAsm.exe 3020 RegAsm.exe 3020 RegAsm.exe 3020 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 3020 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 3020 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.execmd.exetaskeng.exeDDfiles.execmd.exedescription pid process target process PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 3020 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2420 wrote to memory of 1148 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1148 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1148 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1148 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1440 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1440 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1440 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 1440 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 2616 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 2616 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 2616 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2420 wrote to memory of 2616 2420 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 1440 wrote to memory of 2628 1440 cmd.exe schtasks.exe PID 1440 wrote to memory of 2628 1440 cmd.exe schtasks.exe PID 1440 wrote to memory of 2628 1440 cmd.exe schtasks.exe PID 1440 wrote to memory of 2628 1440 cmd.exe schtasks.exe PID 2308 wrote to memory of 2032 2308 taskeng.exe DDfiles.exe PID 2308 wrote to memory of 2032 2308 taskeng.exe DDfiles.exe PID 2308 wrote to memory of 2032 2308 taskeng.exe DDfiles.exe PID 2308 wrote to memory of 2032 2308 taskeng.exe DDfiles.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 648 2032 DDfiles.exe RegAsm.exe PID 2032 wrote to memory of 2816 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2816 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2816 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2816 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2840 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2840 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2840 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2840 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2820 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2820 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2820 2032 DDfiles.exe cmd.exe PID 2032 wrote to memory of 2820 2032 DDfiles.exe cmd.exe PID 2840 wrote to memory of 1920 2840 cmd.exe schtasks.exe PID 2840 wrote to memory of 1920 2840 cmd.exe schtasks.exe PID 2840 wrote to memory of 1920 2840 cmd.exe schtasks.exe PID 2840 wrote to memory of 1920 2840 cmd.exe schtasks.exe PID 2308 wrote to memory of 2168 2308 taskeng.exe DDfiles.exe PID 2308 wrote to memory of 2168 2308 taskeng.exe DDfiles.exe PID 2308 wrote to memory of 2168 2308 taskeng.exe DDfiles.exe PID 2308 wrote to memory of 2168 2308 taskeng.exe DDfiles.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe"C:\Users\Admin\AppData\Local\Temp\26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {78507145-3419-41CB-91AC-98B8F26A667D} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeFilesize
296KB
MD5ec03c8da575fa5ee4745506b340968e6
SHA1357374aa9b28d6571ebcf3b535b3cd8fe85eebba
SHA25626321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
SHA5122d01fa27ef375f77db7e3a896877db902ea52578aaa13aaec2aef3ce8a0199b1de56ca70602bac24f4fd2278ed5835e2c373c0626a05e95929deb93abb94137a
-
memory/1964-65-0x0000000000220000-0x0000000000270000-memory.dmpFilesize
320KB
-
memory/2032-38-0x00000000010A0000-0x00000000010F0000-memory.dmpFilesize
320KB
-
memory/2420-14-0x0000000074AC0000-0x00000000751AE000-memory.dmpFilesize
6.9MB
-
memory/2420-1-0x0000000000850000-0x00000000008A0000-memory.dmpFilesize
320KB
-
memory/2420-2-0x0000000074AC0000-0x00000000751AE000-memory.dmpFilesize
6.9MB
-
memory/2420-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmpFilesize
4KB
-
memory/3020-20-0x00000000004B0000-0x00000000004CE000-memory.dmpFilesize
120KB
-
memory/3020-26-0x0000000000BE0000-0x0000000000BEE000-memory.dmpFilesize
56KB
-
memory/3020-3-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3020-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3020-11-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3020-18-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/3020-19-0x0000000000770000-0x000000000077C000-memory.dmpFilesize
48KB
-
memory/3020-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3020-21-0x0000000000A70000-0x0000000000A7A000-memory.dmpFilesize
40KB
-
memory/3020-24-0x0000000000A80000-0x0000000000A8C000-memory.dmpFilesize
48KB
-
memory/3020-25-0x0000000000BC0000-0x0000000000BDA000-memory.dmpFilesize
104KB
-
memory/3020-13-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3020-30-0x0000000000DC0000-0x0000000000DD4000-memory.dmpFilesize
80KB
-
memory/3020-29-0x0000000000DB0000-0x0000000000DBE000-memory.dmpFilesize
56KB
-
memory/3020-31-0x0000000000DD0000-0x0000000000DE4000-memory.dmpFilesize
80KB
-
memory/3020-28-0x0000000000DA0000-0x0000000000DAC000-memory.dmpFilesize
48KB
-
memory/3020-27-0x0000000000D90000-0x0000000000DA2000-memory.dmpFilesize
72KB
-
memory/3020-33-0x0000000000FD0000-0x0000000000FFE000-memory.dmpFilesize
184KB
-
memory/3020-32-0x0000000000EF0000-0x0000000000EFE000-memory.dmpFilesize
56KB
-
memory/3020-34-0x0000000000F10000-0x0000000000F24000-memory.dmpFilesize
80KB
-
memory/3020-5-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3020-6-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3020-9-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB