Analysis
-
max time kernel
117s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 11:35
Static task
static1
Behavioral task
behavioral1
Sample
d0a9cd1821525f56ddd72540c92e7170N.exe
Resource
win7-20240704-en
General
-
Target
d0a9cd1821525f56ddd72540c92e7170N.exe
-
Size
280KB
-
MD5
d0a9cd1821525f56ddd72540c92e7170
-
SHA1
d43e00b1f8534a15b0e4ba375b9de2e33ab5cee7
-
SHA256
32592d0a4ec9b0fc03f0ec38cc9289634a075640e335a01f4c70b19f42b14729
-
SHA512
1fa0c5d4ff2bc532b9feab8ee4d8e1f1e0af2d4927eb348f6ee1d6adcb6443e33a22b67a9fd85372087350b563ae72b7826326df8273eacbc6ce8df3770fd138
-
SSDEEP
6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKK:boSeGUA5YZazpXUmZhZ6SK
Malware Config
Extracted
nanocore
1.2.2.0
sysupdate24.ddns.net:45400
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2020-04-24T17:41:53.492468936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
45400
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sysupdate24.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d0a9cd1821525f56ddd72540c92e7170N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation d0a9cd1821525f56ddd72540c92e7170N.exe -
Executes dropped EXE 2 IoCs
Processes:
a1punf5t2of.exea1punf5t2of.exepid process 2796 a1punf5t2of.exe 2776 a1punf5t2of.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d0a9cd1821525f56ddd72540c92e7170N.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" d0a9cd1821525f56ddd72540c92e7170N.exe -
Processes:
a1punf5t2of.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1punf5t2of.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1punf5t2of.exedescription pid process target process PID 2796 set thread context of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
a1punf5t2of.exepid process 2776 a1punf5t2of.exe 2776 a1punf5t2of.exe 2776 a1punf5t2of.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a1punf5t2of.exepid process 2776 a1punf5t2of.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1punf5t2of.exedescription pid process Token: SeDebugPrivilege 2776 a1punf5t2of.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d0a9cd1821525f56ddd72540c92e7170N.exea1punf5t2of.exedescription pid process target process PID 3320 wrote to memory of 2796 3320 d0a9cd1821525f56ddd72540c92e7170N.exe a1punf5t2of.exe PID 3320 wrote to memory of 2796 3320 d0a9cd1821525f56ddd72540c92e7170N.exe a1punf5t2of.exe PID 3320 wrote to memory of 2796 3320 d0a9cd1821525f56ddd72540c92e7170N.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe PID 2796 wrote to memory of 2776 2796 a1punf5t2of.exe a1punf5t2of.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0a9cd1821525f56ddd72540c92e7170N.exe"C:\Users\Admin\AppData\Local\Temp\d0a9cd1821525f56ddd72540c92e7170N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exeFilesize
280KB
MD540fe96c595c5f53a2e65429cf23412af
SHA1dfa1fbd82dda08b3855f7345db6de171df7d5aba
SHA256346a06b4ba0232be43a5e89b4be9ebec547896366f4da7966906c461de7aca15
SHA512df203d557ba3b248dde052d92875d235215225964ae6a8cdeea0c8681320493334cb29f5118eaec88aaa8abc18fbdd455d143168c7c15c8b43a934f10fea6f65
-
memory/2776-30-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2776-28-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2776-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-34-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2776-27-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2776-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-26-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2776-35-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2796-20-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2796-17-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2796-31-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2796-33-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/2796-19-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/3320-3-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/3320-18-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/3320-2-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB
-
memory/3320-0-0x0000000074A92000-0x0000000074A93000-memory.dmpFilesize
4KB
-
memory/3320-1-0x0000000074A90000-0x0000000075041000-memory.dmpFilesize
5.7MB