Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 01:05
Static task
static1
Behavioral task
behavioral1
Sample
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe
Resource
win7-20240611-en
General
-
Target
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe
-
Size
296KB
-
MD5
ec03c8da575fa5ee4745506b340968e6
-
SHA1
357374aa9b28d6571ebcf3b535b3cd8fe85eebba
-
SHA256
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
-
SHA512
2d01fa27ef375f77db7e3a896877db902ea52578aaa13aaec2aef3ce8a0199b1de56ca70602bac24f4fd2278ed5835e2c373c0626a05e95929deb93abb94137a
-
SSDEEP
6144:ou+rdxKERB7nPpuU8Dh1tUS/fqLaiU6xVB3Y8TTp6VmSyp7jk:gdxK8B7nAU87tabNNTd6VnypU
Malware Config
Extracted
nanocore
1.2.2.0
munan.duckdns.org:3637
munabc.duckdns.org:3637
4d5a1bc9-ba60-4ed4-85d1-96a1836c92b0
-
activate_away_mode
true
-
backup_connection_host
munabc.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-09-24T00:04:44.813706136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3637
-
default_group
MUNA
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4d5a1bc9-ba60-4ed4-85d1-96a1836c92b0
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
munan.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Detects executables packed with SmartAssembly 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2576-1-0x0000000000580000-0x00000000005D0000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe INDICATOR_EXE_Packed_SmartAssembly -
Executes dropped EXE 3 IoCs
Processes:
DDfiles.exeDDfiles.exeDDfiles.exepid process 4480 DDfiles.exe 3180 DDfiles.exe 4484 DDfiles.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exeDDfiles.exeDDfiles.exeDDfiles.exedescription pid process target process PID 2576 set thread context of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 4480 set thread context of 4248 4480 DDfiles.exe RegAsm.exe PID 3180 set thread context of 2016 3180 DDfiles.exe RegAsm.exe PID 4484 set thread context of 4388 4484 DDfiles.exe RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1776 schtasks.exe 4944 schtasks.exe 4108 schtasks.exe 4504 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegAsm.exepid process 1312 RegAsm.exe 1312 RegAsm.exe 1312 RegAsm.exe 1312 RegAsm.exe 1312 RegAsm.exe 1312 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1312 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1312 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.execmd.exeDDfiles.execmd.exeDDfiles.execmd.exeDDfiles.exedescription pid process target process PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 1312 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe RegAsm.exe PID 2576 wrote to memory of 4876 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4876 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4876 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4812 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4812 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4812 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4904 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4904 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 2576 wrote to memory of 4904 2576 26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe cmd.exe PID 4812 wrote to memory of 1776 4812 cmd.exe schtasks.exe PID 4812 wrote to memory of 1776 4812 cmd.exe schtasks.exe PID 4812 wrote to memory of 1776 4812 cmd.exe schtasks.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 4248 4480 DDfiles.exe RegAsm.exe PID 4480 wrote to memory of 1548 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 1548 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 1548 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 4128 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 4128 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 4128 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 4448 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 4448 4480 DDfiles.exe cmd.exe PID 4480 wrote to memory of 4448 4480 DDfiles.exe cmd.exe PID 4128 wrote to memory of 4944 4128 cmd.exe schtasks.exe PID 4128 wrote to memory of 4944 4128 cmd.exe schtasks.exe PID 4128 wrote to memory of 4944 4128 cmd.exe schtasks.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2016 3180 DDfiles.exe RegAsm.exe PID 3180 wrote to memory of 2588 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 2588 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 2588 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 3184 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 3184 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 3184 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 5072 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 5072 3180 DDfiles.exe cmd.exe PID 3180 wrote to memory of 5072 3180 DDfiles.exe cmd.exe PID 3184 wrote to memory of 4108 3184 cmd.exe schtasks.exe PID 3184 wrote to memory of 4108 3184 cmd.exe schtasks.exe PID 3184 wrote to memory of 4108 3184 cmd.exe schtasks.exe PID 4484 wrote to memory of 4388 4484 DDfiles.exe RegAsm.exe PID 4484 wrote to memory of 4388 4484 DDfiles.exe RegAsm.exe PID 4484 wrote to memory of 4388 4484 DDfiles.exe RegAsm.exe PID 4484 wrote to memory of 4388 4484 DDfiles.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe"C:\Users\Admin\AppData\Local\Temp\26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeC:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\DDfiles"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe'" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe" "C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DDfiles.exe.logFilesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Roaming\DDfiles\DDfiles.exeFilesize
296KB
MD5ec03c8da575fa5ee4745506b340968e6
SHA1357374aa9b28d6571ebcf3b535b3cd8fe85eebba
SHA25626321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
SHA5122d01fa27ef375f77db7e3a896877db902ea52578aaa13aaec2aef3ce8a0199b1de56ca70602bac24f4fd2278ed5835e2c373c0626a05e95929deb93abb94137a
-
memory/1312-20-0x00000000065B0000-0x00000000065BC000-memory.dmpFilesize
48KB
-
memory/1312-23-0x0000000006600000-0x0000000006612000-memory.dmpFilesize
72KB
-
memory/1312-6-0x0000000074C00000-0x00000000753B0000-memory.dmpFilesize
7.7MB
-
memory/1312-38-0x0000000074C00000-0x00000000753B0000-memory.dmpFilesize
7.7MB
-
memory/1312-8-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/1312-9-0x0000000004F20000-0x0000000004FBC000-memory.dmpFilesize
624KB
-
memory/1312-12-0x0000000004E40000-0x0000000004E4A000-memory.dmpFilesize
40KB
-
memory/1312-14-0x00000000051C0000-0x00000000051CA000-memory.dmpFilesize
40KB
-
memory/1312-16-0x0000000005370000-0x000000000538E000-memory.dmpFilesize
120KB
-
memory/1312-15-0x00000000051D0000-0x00000000051DC000-memory.dmpFilesize
48KB
-
memory/1312-17-0x0000000005E20000-0x0000000005E2A000-memory.dmpFilesize
40KB
-
memory/1312-31-0x0000000006890000-0x00000000068F6000-memory.dmpFilesize
408KB
-
memory/1312-21-0x00000000065C0000-0x00000000065DA000-memory.dmpFilesize
104KB
-
memory/1312-4-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1312-26-0x0000000006630000-0x0000000006644000-memory.dmpFilesize
80KB
-
memory/1312-25-0x0000000006620000-0x000000000662E000-memory.dmpFilesize
56KB
-
memory/1312-24-0x0000000006610000-0x000000000661C000-memory.dmpFilesize
48KB
-
memory/1312-22-0x00000000065F0000-0x00000000065FE000-memory.dmpFilesize
56KB
-
memory/1312-30-0x00000000066B0000-0x00000000066C4000-memory.dmpFilesize
80KB
-
memory/1312-29-0x0000000006680000-0x00000000066AE000-memory.dmpFilesize
184KB
-
memory/1312-28-0x0000000006670000-0x000000000667E000-memory.dmpFilesize
56KB
-
memory/1312-27-0x0000000006640000-0x0000000006654000-memory.dmpFilesize
80KB
-
memory/2576-0-0x0000000074C0E000-0x0000000074C0F000-memory.dmpFilesize
4KB
-
memory/2576-3-0x0000000074C00000-0x00000000753B0000-memory.dmpFilesize
7.7MB
-
memory/2576-7-0x0000000074C00000-0x00000000753B0000-memory.dmpFilesize
7.7MB
-
memory/2576-2-0x0000000005480000-0x0000000005A24000-memory.dmpFilesize
5.6MB
-
memory/2576-1-0x0000000000580000-0x00000000005D0000-memory.dmpFilesize
320KB