Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 19:11
Static task
static1
Behavioral task
behavioral1
Sample
ILPEA_MRC2021751433030XMY,pdf.exe
Resource
win7-20240708-en
General
-
Target
ILPEA_MRC2021751433030XMY,pdf.exe
-
Size
680KB
-
MD5
3efde66cdd917e83801b722b04ad1c20
-
SHA1
e26af977f80544526851012f80061acd03ff72a6
-
SHA256
a0aa261b6eca399214785a831f60f317f7fb5795d33fe2a07e330b7aabfc0318
-
SHA512
2c0030d7e624668f35dd067f9e2029918d42f3c47f2923290628e330d0a68c4de24535415245936f403aafcc1bdc4a127c4700407a55a741c89db2ea285f5e9f
-
SSDEEP
12288:3p+aRBZi970Hq83hAkJlk1wA8XyonCo+aUwbjpa1BDCROuTngLsIB:Z9ZhikJKJCx+atpab/WnFW
Malware Config
Extracted
nanocore
1.2.2.0
godismyhelperalways.ddns.net:2030
08e0afad-4bed-4e7d-8205-2bf2bc84e8fb
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-14T17:48:21.782068136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2030
-
default_group
BLESSINGS
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
08e0afad-4bed-4e7d-8205-2bf2bc84e8fb
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
godismyhelperalways.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansvc.exe" ILPEA_MRC2021751433030XMY,pdf.exe -
Processes:
ILPEA_MRC2021751433030XMY,pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ILPEA_MRC2021751433030XMY,pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exedescription pid process target process PID 1000 set thread context of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exedescription ioc process File created C:\Program Files (x86)\WAN Service\wansvc.exe ILPEA_MRC2021751433030XMY,pdf.exe File opened for modification C:\Program Files (x86)\WAN Service\wansvc.exe ILPEA_MRC2021751433030XMY,pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exeILPEA_MRC2021751433030XMY,pdf.exepid process 1000 ILPEA_MRC2021751433030XMY,pdf.exe 1000 ILPEA_MRC2021751433030XMY,pdf.exe 1000 ILPEA_MRC2021751433030XMY,pdf.exe 2704 ILPEA_MRC2021751433030XMY,pdf.exe 2704 ILPEA_MRC2021751433030XMY,pdf.exe 2704 ILPEA_MRC2021751433030XMY,pdf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exepid process 2704 ILPEA_MRC2021751433030XMY,pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exeILPEA_MRC2021751433030XMY,pdf.exedescription pid process Token: SeDebugPrivilege 1000 ILPEA_MRC2021751433030XMY,pdf.exe Token: SeDebugPrivilege 2704 ILPEA_MRC2021751433030XMY,pdf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ILPEA_MRC2021751433030XMY,pdf.exedescription pid process target process PID 1000 wrote to memory of 2832 1000 ILPEA_MRC2021751433030XMY,pdf.exe schtasks.exe PID 1000 wrote to memory of 2832 1000 ILPEA_MRC2021751433030XMY,pdf.exe schtasks.exe PID 1000 wrote to memory of 2832 1000 ILPEA_MRC2021751433030XMY,pdf.exe schtasks.exe PID 1000 wrote to memory of 2832 1000 ILPEA_MRC2021751433030XMY,pdf.exe schtasks.exe PID 1000 wrote to memory of 2724 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2724 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2724 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2724 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe PID 1000 wrote to memory of 2704 1000 ILPEA_MRC2021751433030XMY,pdf.exe ILPEA_MRC2021751433030XMY,pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ILPEA_MRC2021751433030XMY,pdf.exe"C:\Users\Admin\AppData\Local\Temp\ILPEA_MRC2021751433030XMY,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ozUZdsdZtGvsul" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BFC.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\ILPEA_MRC2021751433030XMY,pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ILPEA_MRC2021751433030XMY,pdf.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6BFC.tmpFilesize
1KB
MD5328293e3ad1771a6cb66b034c9ffc89c
SHA166ea6ebf610ea2c13f684e44cb9ece9a2147a158
SHA256c3db6ff3a8e5cb5d998381dee416307e07b91316966abcf680edf7245245b030
SHA512e2be7feaabb80e7f2ce5b01e4181f0270416ac064bd402f033c0ff291ecbfcff0faf8caa4e75ff72744feab3f4607221e8c70f4091e1cd453671958892d10cce
-
memory/1000-0-0x0000000074FE1000-0x0000000074FE2000-memory.dmpFilesize
4KB
-
memory/1000-1-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/1000-2-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/1000-3-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/1000-4-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/1000-21-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/2704-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2704-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2704-23-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/2704-22-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB
-
memory/2704-26-0x0000000074FE0000-0x000000007558B000-memory.dmpFilesize
5.7MB