nanocore | 503ed2fe2fe3234cc7128db7d881fd287e090bbee42a11df458724e4440d4d8a

Analysis

max time kernel
144s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-09-2024 14:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

put dthang in jail pwease.exe
Size

203KB
MD5

d6ea53e1e203584d3e063c910059f6be
SHA1

da189f04674239003cd33c3d6e2e81c91baa24ad
SHA256

503ed2fe2fe3234cc7128db7d881fd287e090bbee42a11df458724e4440d4d8a
SHA512

40532241af33d6fa8fdf72c230733d366cbf93488bfe670fa13158add537abf1b174aab29cdc64faacc47b24703ce5b4b73feae98606d9f221b230aa305c08d5
SSDEEP

3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/5LZFSGH+2AgQ7S8xaP4W9rsG:MLV6Bta6dtJmakIM52LZFFYSEY4ers32

Score

10^/10

nanocore collection credential_access discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

139.64.43.87:54984

Mutex

1bb01243-c471-43ce-be63-d687938a8a8b

Attributes

activate_away_mode
true
backup_connection_host
139.64.43.87
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-06-24T15:54:02.637007336Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1bb01243-c471-43ce-be63-d687938a8a8b
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/3732-15-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/3732-17-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/3732-18-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/3732-22-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/3732-15-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/3732-17-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/3732-18-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/3732-22-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe"	put dthang in jail pwease.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	put dthang in jail pwease.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 set thread context of 1652	1640	put dthang in jail pwease.exe	79

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe	put dthang in jail pwease.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisvc.exe	put dthang in jail pwease.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	put dthang in jail pwease.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
200	schtasks.exe
2564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1652	vbc.exe
1652	vbc.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
4360	taskmgr.exe
4360	taskmgr.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
1640	put dthang in jail pwease.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	put dthang in jail pwease.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	put dthang in jail pwease.exe
Token: SeDebugPrivilege	4360	taskmgr.exe
Token: SeSystemProfilePrivilege	4360	taskmgr.exe
Token: SeCreateGlobalPrivilege	4360	taskmgr.exe
Token: SeShutdownPrivilege	1640	put dthang in jail pwease.exe
Token: SeDebugPrivilege	1640	put dthang in jail pwease.exe
Token: SeDebugPrivilege	1640	put dthang in jail pwease.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe
4360	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1476	LogonUI.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 200	1640	put dthang in jail pwease.exe	74
PID 1640 wrote to memory of 200	1640	put dthang in jail pwease.exe	74
PID 1640 wrote to memory of 200	1640	put dthang in jail pwease.exe	74
PID 1640 wrote to memory of 2564	1640	put dthang in jail pwease.exe	76
PID 1640 wrote to memory of 2564	1640	put dthang in jail pwease.exe	76
PID 1640 wrote to memory of 2564	1640	put dthang in jail pwease.exe	76
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 3732	1640	put dthang in jail pwease.exe	78
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79
PID 1640 wrote to memory of 1652	1640	put dthang in jail pwease.exe	79

C:\Users\Admin\AppData\Local\Temp\put dthang in jail pwease.exe
"C:\Users\Admin\AppData\Local\Temp\put dthang in jail pwease.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6726.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:200
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6785.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2564
- \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
  "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\bve0grpt.ypg"
  2⤵
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:3732
- \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
  "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\ggyibtu0.e4k"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1652

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a99855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DPI Service\dpisvc.exe

Filesize
203KB

MD5
d6ea53e1e203584d3e063c910059f6be

SHA1
da189f04674239003cd33c3d6e2e81c91baa24ad

SHA256
503ed2fe2fe3234cc7128db7d881fd287e090bbee42a11df458724e4440d4d8a

SHA512
40532241af33d6fa8fdf72c230733d366cbf93488bfe670fa13158add537abf1b174aab29cdc64faacc47b24703ce5b4b73feae98606d9f221b230aa305c08d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bve0grpt.ypg

Filesize
523B

MD5
69b2a2e17e78d24abee9f1de2f04811a

SHA1
d19c109704e83876ab3527457f9418a7d053aa33

SHA256
1b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd

SHA512
eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ggyibtu0.e4k

Filesize
3KB

MD5
02524418240369b25b988e9884cd1c54

SHA1
42a33322d952edf6d8431d4cd788bbc863d2b890

SHA256
80b2a0874c2f734dfe1196d7ae2a7bc6ccb30df2d9281513ac33edc529a71a37

SHA512
7c5bbe911f7f0b072d6fdb89ea5759655c2b5cf9ebfddff8f2f67f956141b8ed3697ab0504f60c3992849afbbc79434043a6c04d7cf6ddd958e23354fd3a698f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6726.tmp

Filesize
1KB

MD5
d8fa84e2f4ddd52571adeaca0d9ed1fc

SHA1
cd5b26e739cca1b4044e7a4ff248dd2cf430b4a2

SHA256
2656d494e52a7aec3ce0d2130c145d6f565056c3180753430c37a4a88edfa451

SHA512
8283656bf338e8fbf3f97de1686c59e64eae0641b4671644b381a867274af269e5b7e8b9f9b480347a4a826d558f40b9fcf815c41985bc6392448cde3bbeed05

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6785.tmp

Filesize
1KB

MD5
0d6d94a917c4ce63da6bc50cbbe0dc5d

SHA1
599564f60649f3f4c14478e9cb184000d4280a61

SHA256
e82a4b8311319f1b68cb06ae5b670e97a11c467b1bdb0ebf130f523bf98ca522

SHA512
23ac6a088e2a1df3d75d2aca17cdcc5a4147b966758e4acc4d904293f4693f362db637d8135edd670e158bec77e788e915f2a55042a2f1aec09a4679bc749412

Download Submit
C:\Users\Admin\AppData\Roaming\98F325B1-1085-43B7-8E27-43D9CDB6EA3F\settings.bin

Filesize
40B

MD5
4e5e92e2369688041cc82ef9650eded2

SHA1
15e44f2f3194ee232b44e9684163b6f66472c862

SHA256
f8098a6290118f2944b9e7c842bd014377d45844379f863b00d54515a8a64b48

SHA512
1b368018907a3bc30421fda2c935b39dc9073b9b1248881e70ad48edb6caa256070c1a90b97b0f64bbe61e316dbb8d5b2ec8dbabcd0b0b2999ab50b933671ecb

Download Submit
memory/1640-1-0x0000000073BC0000-0x0000000074170000-memory.dmp

Filesize
5.7MB

Download
memory/1640-2-0x0000000073BC0000-0x0000000074170000-memory.dmp

Filesize
5.7MB

Download
memory/1640-13-0x0000000073BC0000-0x0000000074170000-memory.dmp

Filesize
5.7MB

Download
memory/1640-14-0x0000000073BC0000-0x0000000074170000-memory.dmp

Filesize
5.7MB

Download
memory/1640-49-0x0000000073BC0000-0x0000000074170000-memory.dmp

Filesize
5.7MB

Download
memory/1640-0-0x0000000073BC1000-0x0000000073BC2000-memory.dmp

Filesize
4KB

Download
memory/1652-27-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1652-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1652-26-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1652-34-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3732-20-0x0000000000420000-0x00000000004E5000-memory.dmp

Filesize
788KB

Download
memory/3732-22-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3732-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3732-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3732-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads