Analysis
-
max time kernel
34s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 00:13
Static task
static1
Behavioral task
behavioral1
Sample
1a9cbbcde60025ea46710614379aeeb0N.exe
Resource
win7-20240705-en
General
-
Target
1a9cbbcde60025ea46710614379aeeb0N.exe
-
Size
706KB
-
MD5
1a9cbbcde60025ea46710614379aeeb0
-
SHA1
d558f733f942c2f6418d2e6125526f80855ceed7
-
SHA256
97dfeb60879ee1c289fee39461c9c4bdc5d377b0231298370b07485df9af8177
-
SHA512
4cba4bb11158206167cc6bdc455d7c8d03b1bf30c6aeaece73bb3c547c3a655292bbe03ed112f4370c0253b99bdf8fdde0de92fb40e21d659f5a9c93edab0602
-
SSDEEP
12288:ZIbNtJKxao0NYbmJBHltC9AOTTA6IF2xPo5T+9p2WlC/E:uxtwaogYbm7yAO3FIF2a5yt4/
Malware Config
Extracted
nanocore
1.2.2.0
newsddawork.3utilities.com:1620
maxlogs.webhop.me:1620
1fa46b72-10f9-4da3-bc15-84dde165706d
-
activate_away_mode
true
-
backup_connection_host
maxlogs.webhop.me
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-02-17T03:41:10.727034736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1620
-
default_group
NewBin
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1fa46b72-10f9-4da3-bc15-84dde165706d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
newsddawork.3utilities.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Subsystem = "C:\\Program Files (x86)\\AGP Subsystem\\agpss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a9cbbcde60025ea46710614379aeeb0N.exedescription pid process target process PID 2688 set thread context of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\AGP Subsystem\agpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\AGP Subsystem\agpss.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegSvcs.exepid process 2452 RegSvcs.exe 2452 RegSvcs.exe 2452 RegSvcs.exe 2452 RegSvcs.exe 2452 RegSvcs.exe 2452 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2452 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2452 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1a9cbbcde60025ea46710614379aeeb0N.exedescription pid process target process PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 2688 wrote to memory of 2452 2688 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a9cbbcde60025ea46710614379aeeb0N.exe"C:\Users\Admin\AppData\Local\Temp\1a9cbbcde60025ea46710614379aeeb0N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2452-21-0x0000000074E40000-0x000000007552E000-memory.dmpFilesize
6.9MB
-
memory/2452-34-0x0000000000BD0000-0x0000000000BDE000-memory.dmpFilesize
56KB
-
memory/2452-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-20-0x0000000074E40000-0x000000007552E000-memory.dmpFilesize
6.9MB
-
memory/2452-42-0x0000000074E40000-0x000000007552E000-memory.dmpFilesize
6.9MB
-
memory/2452-41-0x0000000074E40000-0x000000007552E000-memory.dmpFilesize
6.9MB
-
memory/2452-40-0x0000000000F10000-0x0000000000F24000-memory.dmpFilesize
80KB
-
memory/2452-39-0x0000000005280000-0x00000000052AE000-memory.dmpFilesize
184KB
-
memory/2452-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-38-0x0000000000D80000-0x0000000000D8E000-memory.dmpFilesize
56KB
-
memory/2452-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2452-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2452-37-0x0000000000D70000-0x0000000000D84000-memory.dmpFilesize
80KB
-
memory/2452-36-0x0000000000C40000-0x0000000000C50000-memory.dmpFilesize
64KB
-
memory/2452-35-0x0000000000C30000-0x0000000000C44000-memory.dmpFilesize
80KB
-
memory/2452-24-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/2452-25-0x0000000000470000-0x000000000048E000-memory.dmpFilesize
120KB
-
memory/2452-26-0x0000000000490000-0x000000000049A000-memory.dmpFilesize
40KB
-
memory/2452-29-0x0000000000580000-0x0000000000592000-memory.dmpFilesize
72KB
-
memory/2452-30-0x0000000000730000-0x000000000074A000-memory.dmpFilesize
104KB
-
memory/2452-31-0x00000000007E0000-0x00000000007EE000-memory.dmpFilesize
56KB
-
memory/2452-32-0x00000000009A0000-0x00000000009B2000-memory.dmpFilesize
72KB
-
memory/2452-33-0x0000000000B80000-0x0000000000B8C000-memory.dmpFilesize
48KB
-
memory/2688-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmpFilesize
4KB
-
memory/2688-1-0x00000000001D0000-0x0000000000286000-memory.dmpFilesize
728KB
-
memory/2688-3-0x0000000002060000-0x0000000002114000-memory.dmpFilesize
720KB
-
memory/2688-2-0x0000000074E40000-0x000000007552E000-memory.dmpFilesize
6.9MB
-
memory/2688-19-0x0000000074E40000-0x000000007552E000-memory.dmpFilesize
6.9MB
-
memory/2688-7-0x0000000004DF0000-0x0000000004E6A000-memory.dmpFilesize
488KB
-
memory/2688-6-0x0000000000710000-0x000000000071C000-memory.dmpFilesize
48KB
-
memory/2688-5-0x0000000000450000-0x0000000000458000-memory.dmpFilesize
32KB
-
memory/2688-4-0x00000000006F0000-0x000000000070A000-memory.dmpFilesize
104KB