Analysis
-
max time kernel
92s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 00:13
Static task
static1
Behavioral task
behavioral1
Sample
1a9cbbcde60025ea46710614379aeeb0N.exe
Resource
win7-20240705-en
General
-
Target
1a9cbbcde60025ea46710614379aeeb0N.exe
-
Size
706KB
-
MD5
1a9cbbcde60025ea46710614379aeeb0
-
SHA1
d558f733f942c2f6418d2e6125526f80855ceed7
-
SHA256
97dfeb60879ee1c289fee39461c9c4bdc5d377b0231298370b07485df9af8177
-
SHA512
4cba4bb11158206167cc6bdc455d7c8d03b1bf30c6aeaece73bb3c547c3a655292bbe03ed112f4370c0253b99bdf8fdde0de92fb40e21d659f5a9c93edab0602
-
SSDEEP
12288:ZIbNtJKxao0NYbmJBHltC9AOTTA6IF2xPo5T+9p2WlC/E:uxtwaogYbm7yAO3FIF2a5yt4/
Malware Config
Extracted
nanocore
1.2.2.0
newsddawork.3utilities.com:1620
maxlogs.webhop.me:1620
1fa46b72-10f9-4da3-bc15-84dde165706d
-
activate_away_mode
true
-
backup_connection_host
maxlogs.webhop.me
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-02-17T03:41:10.727034736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1620
-
default_group
NewBin
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
1fa46b72-10f9-4da3-bc15-84dde165706d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
newsddawork.3utilities.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAT Subsystem = "C:\\Program Files (x86)\\NAT Subsystem\\natss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a9cbbcde60025ea46710614379aeeb0N.exedescription pid process target process PID 1936 set thread context of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\NAT Subsystem\natss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\NAT Subsystem\natss.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
1a9cbbcde60025ea46710614379aeeb0N.exeRegSvcs.exepid process 1936 1a9cbbcde60025ea46710614379aeeb0N.exe 1936 1a9cbbcde60025ea46710614379aeeb0N.exe 4524 RegSvcs.exe 4524 RegSvcs.exe 4524 RegSvcs.exe 4524 RegSvcs.exe 4524 RegSvcs.exe 4524 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4524 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1a9cbbcde60025ea46710614379aeeb0N.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1936 1a9cbbcde60025ea46710614379aeeb0N.exe Token: SeDebugPrivilege 4524 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1a9cbbcde60025ea46710614379aeeb0N.exedescription pid process target process PID 1936 wrote to memory of 2300 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 2300 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 2300 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe PID 1936 wrote to memory of 4524 1936 1a9cbbcde60025ea46710614379aeeb0N.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a9cbbcde60025ea46710614379aeeb0N.exe"C:\Users\Admin\AppData\Local\Temp\1a9cbbcde60025ea46710614379aeeb0N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1936-15-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/1936-1-0x00000000002F0000-0x00000000003A6000-memory.dmpFilesize
728KB
-
memory/1936-2-0x00000000054C0000-0x0000000005A64000-memory.dmpFilesize
5.6MB
-
memory/1936-3-0x0000000004DD0000-0x0000000004E62000-memory.dmpFilesize
584KB
-
memory/1936-4-0x0000000004DB0000-0x0000000004DBA000-memory.dmpFilesize
40KB
-
memory/1936-5-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/1936-6-0x00000000077B0000-0x0000000007864000-memory.dmpFilesize
720KB
-
memory/1936-7-0x0000000004F70000-0x0000000004F8A000-memory.dmpFilesize
104KB
-
memory/1936-8-0x00000000051A0000-0x00000000051A8000-memory.dmpFilesize
32KB
-
memory/1936-9-0x0000000005F70000-0x0000000005F7C000-memory.dmpFilesize
48KB
-
memory/1936-10-0x0000000006210000-0x000000000628A000-memory.dmpFilesize
488KB
-
memory/1936-11-0x0000000010670000-0x000000001070C000-memory.dmpFilesize
624KB
-
memory/1936-0-0x0000000074F7E000-0x0000000074F7F000-memory.dmpFilesize
4KB
-
memory/4524-19-0x0000000004F20000-0x0000000004F2A000-memory.dmpFilesize
40KB
-
memory/4524-27-0x0000000006470000-0x0000000006482000-memory.dmpFilesize
72KB
-
memory/4524-16-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/4524-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4524-20-0x00000000050E0000-0x00000000050FE000-memory.dmpFilesize
120KB
-
memory/4524-21-0x00000000052E0000-0x00000000052EA000-memory.dmpFilesize
40KB
-
memory/4524-24-0x0000000005300000-0x0000000005312000-memory.dmpFilesize
72KB
-
memory/4524-25-0x0000000006430000-0x000000000644A000-memory.dmpFilesize
104KB
-
memory/4524-26-0x0000000006460000-0x000000000646E000-memory.dmpFilesize
56KB
-
memory/4524-14-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/4524-28-0x0000000006480000-0x000000000648C000-memory.dmpFilesize
48KB
-
memory/4524-29-0x0000000006490000-0x000000000649E000-memory.dmpFilesize
56KB
-
memory/4524-30-0x00000000064A0000-0x00000000064B4000-memory.dmpFilesize
80KB
-
memory/4524-31-0x00000000064B0000-0x00000000064C0000-memory.dmpFilesize
64KB
-
memory/4524-32-0x00000000064D0000-0x00000000064E4000-memory.dmpFilesize
80KB
-
memory/4524-33-0x00000000064F0000-0x00000000064FE000-memory.dmpFilesize
56KB
-
memory/4524-35-0x0000000006540000-0x0000000006554000-memory.dmpFilesize
80KB
-
memory/4524-34-0x0000000006500000-0x000000000652E000-memory.dmpFilesize
184KB
-
memory/4524-36-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/4524-37-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB