Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-08-2024 00:39
Static task
static1
Behavioral task
behavioral1
Sample
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe
Resource
win10v2004-20240802-en
General
-
Target
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe
-
Size
282KB
-
MD5
930b881844c3567acf81f0965fa35975
-
SHA1
559d769f6d6205ff6a2d3a206467ea5cb883fa17
-
SHA256
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8
-
SHA512
e33dbeac484de2937d82eda3471fa38cfcea8f59bff12c165a19151c5517940c6365c245dc954f1df9ee19025f8b151f3210b5259e0497d0f6ddf3fa2ac8881b
-
SSDEEP
6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfP:boSeGUA5YZazpXUmZhZ6Su
Malware Config
Extracted
nanocore
1.2.2.0
sysupdate24.ddns.net:45400
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2020-04-24T17:41:53.492468936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
45400
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sysupdate24.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
a1punf5t2of.exea1punf5t2of.exepid process 2468 a1punf5t2of.exe 2612 a1punf5t2of.exe -
Loads dropped DLL 2 IoCs
Processes:
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exea1punf5t2of.exepid process 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe 2468 a1punf5t2of.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe -
Processes:
a1punf5t2of.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1punf5t2of.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1punf5t2of.exedescription pid process target process PID 2468 set thread context of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a1punf5t2of.exea1punf5t2of.exe98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1punf5t2of.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1punf5t2of.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
a1punf5t2of.exepid process 2612 a1punf5t2of.exe 2612 a1punf5t2of.exe 2612 a1punf5t2of.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a1punf5t2of.exepid process 2612 a1punf5t2of.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1punf5t2of.exedescription pid process Token: SeDebugPrivilege 2612 a1punf5t2of.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exea1punf5t2of.exedescription pid process target process PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2120 wrote to memory of 2468 2120 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe PID 2468 wrote to memory of 2612 2468 a1punf5t2of.exe a1punf5t2of.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe"C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
282KB
MD549c1c8b69ccd93aabe88df99714f5701
SHA147bb331b05f29229f425a7cba8b2cdd4b56a0128
SHA256ec5fdeb914f81e0b6a16b304a18c269a39bf88e6509479f2e8306c35729b09a5
SHA512961f2968d024cd465e438ddd989d6debb7c91c241aa02b4f147e3de55f07c5f08717b155e30109fde251aec7dd4b7673996397c8f9819c26d6a5dc44bf6fe927