Analysis Overview
SHA256
ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925
Threat Level: Known bad
The file ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe was found to be: Known bad.
Malicious Activity Summary
NanoCore
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Gathers network information
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-05 01:59
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-05 01:59
Reported
2024-08-05 02:02
Platform
win7-20240704-en
Max time kernel
45s
Max time network
153s
Command Line
Signatures
NanoCore
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Notepad! = "C:\\Users\\Admin\\AppData\\Roaming\\Notepad!.exe" | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2132 set thread context of 4948 | N/A | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\ipconfig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\ipconfig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Gathers network information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\ipconfig.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\ipconfig.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe
"C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | indialongvenomminister01connection.myddns.rocks | udp |
| US | 198.23.201.84:54980 | indialongvenomminister01connection.myddns.rocks | tcp |
Files
memory/2132-0-0x000000007451E000-0x000000007451F000-memory.dmp
memory/2132-1-0x0000000000040000-0x00000000002AE000-memory.dmp
memory/2132-2-0x0000000004A30000-0x0000000004B2C000-memory.dmp
memory/2132-3-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-28-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-34-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-32-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-31-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-26-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-24-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-22-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-20-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-18-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-16-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-14-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-12-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-10-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-8-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-6-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-4-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-38-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-53-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-62-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-66-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-64-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-60-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-58-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-56-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-54-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-50-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-48-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-46-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-44-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-42-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-40-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-36-0x0000000004A30000-0x0000000004B26000-memory.dmp
memory/2132-1039-0x0000000074510000-0x0000000074BFE000-memory.dmp
memory/2132-1041-0x0000000004BB0000-0x0000000004BFC000-memory.dmp
memory/2132-1040-0x0000000004820000-0x000000000489C000-memory.dmp
memory/2132-1042-0x0000000074510000-0x0000000074BFE000-memory.dmp
memory/2132-1043-0x000000007451E000-0x000000007451F000-memory.dmp
memory/2132-1044-0x0000000074510000-0x0000000074BFE000-memory.dmp
memory/2132-1045-0x0000000004C50000-0x0000000004CA4000-memory.dmp
memory/4948-1058-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4948-1060-0x0000000000360000-0x000000000036A000-memory.dmp
memory/4948-1061-0x0000000000380000-0x000000000039E000-memory.dmp
memory/4948-1062-0x00000000003A0000-0x00000000003AA000-memory.dmp
memory/4948-1065-0x0000000000510000-0x000000000051C000-memory.dmp
memory/4948-1066-0x0000000000520000-0x000000000053A000-memory.dmp
memory/4948-1067-0x0000000000650000-0x000000000065E000-memory.dmp
memory/4948-1068-0x0000000000660000-0x0000000000672000-memory.dmp
memory/4948-1070-0x0000000000710000-0x000000000071C000-memory.dmp
memory/4948-1071-0x0000000000720000-0x0000000000734000-memory.dmp
memory/4948-1069-0x0000000000700000-0x000000000070E000-memory.dmp
memory/4948-1072-0x0000000000730000-0x0000000000740000-memory.dmp
memory/4948-1073-0x0000000000920000-0x0000000000934000-memory.dmp
memory/4948-1075-0x0000000002340000-0x000000000236E000-memory.dmp
memory/4948-1074-0x0000000000970000-0x000000000097E000-memory.dmp
memory/4948-1076-0x0000000000990000-0x00000000009A4000-memory.dmp
memory/2132-1083-0x0000000074510000-0x0000000074BFE000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-05 01:59
Reported
2024-08-05 02:02
Platform
win10v2004-20240802-en
Max time kernel
95s
Max time network
150s
Command Line
Signatures
NanoCore
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Notepad! = "C:\\Users\\Admin\\AppData\\Roaming\\Notepad!.exe" | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5016 set thread context of 2152 | N/A | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\ipconfig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\ipconfig.exe | N/A |
Gathers network information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\ipconfig.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\ipconfig.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe
"C:\Users\Admin\AppData\Local\Temp\ee556a159fee1cb48604262ca59aa12928567e78523eed65d31727094ff07925.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | indialongvenomminister01connection.myddns.rocks | udp |
| US | 198.23.201.84:54980 | indialongvenomminister01connection.myddns.rocks | tcp |
| US | 8.8.8.8:53 | 84.201.23.198.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 52.111.229.43:443 | tcp | |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
Files
memory/5016-0-0x000000007493E000-0x000000007493F000-memory.dmp
memory/5016-1-0x00000000000C0000-0x000000000032E000-memory.dmp
memory/5016-2-0x0000000004E00000-0x0000000004EFC000-memory.dmp
memory/5016-10-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-18-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-66-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-64-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-62-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-56-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-54-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-48-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-46-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-44-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-42-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-38-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-36-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-34-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-32-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-30-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-24-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-22-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-20-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-16-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-14-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-12-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-8-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-6-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-4-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-60-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-58-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-52-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-50-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-40-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-28-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-26-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-3-0x0000000004E00000-0x0000000004EF6000-memory.dmp
memory/5016-1039-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/5016-1040-0x0000000004FE0000-0x000000000505C000-memory.dmp
memory/5016-1041-0x0000000005060000-0x00000000050AC000-memory.dmp
memory/5016-1042-0x000000007493E000-0x000000007493F000-memory.dmp
memory/5016-1043-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/5016-1045-0x0000000004D80000-0x0000000004DD4000-memory.dmp
memory/5016-1044-0x0000000006310000-0x00000000068B4000-memory.dmp
memory/2152-1049-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/2152-1050-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2152-1051-0x00000000054E0000-0x0000000005572000-memory.dmp
memory/2152-1052-0x0000000005580000-0x000000000561C000-memory.dmp
memory/2152-1053-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/2152-1054-0x00000000054A0000-0x00000000054AA000-memory.dmp
memory/2152-1056-0x0000000005750000-0x000000000575A000-memory.dmp
memory/2152-1057-0x00000000059C0000-0x00000000059DE000-memory.dmp
memory/2152-1058-0x0000000006460000-0x000000000646A000-memory.dmp
memory/2152-1062-0x0000000006AD0000-0x0000000006AEA000-memory.dmp
memory/2152-1070-0x0000000006B90000-0x0000000006B9E000-memory.dmp
memory/2152-1072-0x0000000006BD0000-0x0000000006BE4000-memory.dmp
memory/2152-1071-0x0000000006BA0000-0x0000000006BCE000-memory.dmp
memory/2152-1069-0x0000000006B70000-0x0000000006B84000-memory.dmp
memory/2152-1068-0x0000000006B50000-0x0000000006B60000-memory.dmp
memory/2152-1067-0x0000000006B40000-0x0000000006B54000-memory.dmp
memory/2152-1066-0x0000000006B30000-0x0000000006B3C000-memory.dmp
memory/2152-1065-0x0000000006B20000-0x0000000006B2E000-memory.dmp
memory/2152-1064-0x0000000006B10000-0x0000000006B22000-memory.dmp
memory/2152-1063-0x0000000006B00000-0x0000000006B0E000-memory.dmp
memory/2152-1061-0x0000000006AC0000-0x0000000006ACC000-memory.dmp
memory/2152-1073-0x0000000006EE0000-0x0000000006F46000-memory.dmp
memory/5016-1075-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/2152-1076-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/2152-1077-0x0000000074930000-0x00000000750E0000-memory.dmp