Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
POEA MEMORANDUM N0 056.exe
Resource
win7-20240708-en
General
-
Target
POEA MEMORANDUM N0 056.exe
-
Size
680KB
-
MD5
f456b551503ad95921e9cc9a3fb117be
-
SHA1
03fdfe9e9d663f5c3d013b8ee9e9dab46bdda990
-
SHA256
ea37dd28632e9d1cbba36da7d3daea76d4071af9f75d9afb29265edf1660aba1
-
SHA512
2070fef9bb60225d53a483ddb4cda75823c8f45f8abfd25a036301564dd23ebf3f04aee9bc7e707f0802c83e025ef672c488367da4b6770f93c4318f10f2491a
-
SSDEEP
12288:JcDUU1s3qeEP9VtBDMR7NuXXTT7jIm+HbAnQ97dtabaiFW8E6XorKbi8P5aUL5mf:JM1sav9v078TTHZ+7G47zzig2ou
Malware Config
Extracted
nanocore
1.2.2.0
shahzad73.casacam.net:9036
shahzad73.ddns.net:9036
c4cca249-81f6-4232-9f14-01569e09f5f0
-
activate_away_mode
true
-
backup_connection_host
shahzad73.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-06T13:23:03.514637236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9036
-
default_group
JANUARY
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c4cca249-81f6-4232-9f14-01569e09f5f0
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
shahzad73.casacam.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
POEA MEMORANDUM N0 056.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation POEA MEMORANDUM N0 056.exe -
Processes:
POEA MEMORANDUM N0 056.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA POEA MEMORANDUM N0 056.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
POEA MEMORANDUM N0 056.exedescription pid process target process PID 1684 set thread context of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4984 schtasks.exe 4632 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
POEA MEMORANDUM N0 056.exePOEA MEMORANDUM N0 056.exepid process 1684 POEA MEMORANDUM N0 056.exe 968 POEA MEMORANDUM N0 056.exe 968 POEA MEMORANDUM N0 056.exe 968 POEA MEMORANDUM N0 056.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
POEA MEMORANDUM N0 056.exepid process 968 POEA MEMORANDUM N0 056.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
POEA MEMORANDUM N0 056.exePOEA MEMORANDUM N0 056.exedescription pid process Token: SeDebugPrivilege 1684 POEA MEMORANDUM N0 056.exe Token: SeDebugPrivilege 968 POEA MEMORANDUM N0 056.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
POEA MEMORANDUM N0 056.exePOEA MEMORANDUM N0 056.exedescription pid process target process PID 1684 wrote to memory of 4632 1684 POEA MEMORANDUM N0 056.exe schtasks.exe PID 1684 wrote to memory of 4632 1684 POEA MEMORANDUM N0 056.exe schtasks.exe PID 1684 wrote to memory of 4632 1684 POEA MEMORANDUM N0 056.exe schtasks.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 1684 wrote to memory of 968 1684 POEA MEMORANDUM N0 056.exe POEA MEMORANDUM N0 056.exe PID 968 wrote to memory of 4984 968 POEA MEMORANDUM N0 056.exe schtasks.exe PID 968 wrote to memory of 4984 968 POEA MEMORANDUM N0 056.exe schtasks.exe PID 968 wrote to memory of 4984 968 POEA MEMORANDUM N0 056.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\POEA MEMORANDUM N0 056.exe"C:\Users\Admin\AppData\Local\Temp\POEA MEMORANDUM N0 056.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jqKaAumEoCrxw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AA3.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\POEA MEMORANDUM N0 056.exe"{path}"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NAT Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp414A.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3AA3.tmpFilesize
1KB
MD522116f960bc74abfcc55b82fb9c68419
SHA10748d2b2359487dbed95b43f6b1528cd287dad5e
SHA2562473c60cf47a3e5e6573bdf3a1b9a144367a5f5e2cd88d04788c6c88272a01e1
SHA512210022321f01b229d425baddc643cd73ed1442c8675f0b501b5c32dbe9d3dae1ae470bc28025f401066177eabbddd9b4edfc65349cb149648345ef54e01adeaf
-
C:\Users\Admin\AppData\Local\Temp\tmp414A.tmpFilesize
1KB
MD5a0d3f038d2edfb329b06bdf9124625f4
SHA165ded73c490282c57cf84e21cb316c78105412e2
SHA256f5d2338f5e6526200d60a203691f654e023ee3802a0117488166d0d2d77fd233
SHA51231a817631e2d14236d704d26eb88822b337ab55d03b69ec473ddaef59847e16533edd28187ac7846926f1c9d90ab46919f758f474fdfeab8dfb8f54a373396ff
-
memory/968-27-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/968-26-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/968-25-0x0000000006700000-0x000000000670A000-memory.dmpFilesize
40KB
-
memory/968-24-0x00000000065D0000-0x00000000065EE000-memory.dmpFilesize
120KB
-
memory/968-23-0x00000000057C0000-0x00000000057CA000-memory.dmpFilesize
40KB
-
memory/968-18-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/968-16-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/968-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1684-4-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/1684-10-0x00000000079F0000-0x0000000007A7C000-memory.dmpFilesize
560KB
-
memory/1684-9-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/1684-8-0x0000000074A6E000-0x0000000074A6F000-memory.dmpFilesize
4KB
-
memory/1684-17-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/1684-7-0x00000000052A0000-0x00000000052A8000-memory.dmpFilesize
32KB
-
memory/1684-6-0x0000000007950000-0x00000000079EC000-memory.dmpFilesize
624KB
-
memory/1684-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmpFilesize
4KB
-
memory/1684-5-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/1684-3-0x0000000004C10000-0x0000000004CA2000-memory.dmpFilesize
584KB
-
memory/1684-2-0x00000000052C0000-0x0000000005864000-memory.dmpFilesize
5.6MB
-
memory/1684-1-0x0000000000300000-0x00000000003B0000-memory.dmpFilesize
704KB