Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 05:04 UTC

General

  • Target

    PROOF OF PAYMENT.exe

  • Size

    769KB

  • MD5

    74b1f9ccfc3a8cd599c6565187306657

  • SHA1

    447362e6ac5562132324147636b2c5f13ed7e87e

  • SHA256

    8c6515ea1d1dc1263f76e273d06eee09ce298ddaefa435b84bb6e5bc9b578da1

  • SHA512

    c88740b94abe0fc862560525566b6c8482cc04c59f43c85b5ee8220db546eeb77990cea5a792aa0928341152371a1b84e27df7abb6bdedad5982937cb0128821

  • SSDEEP

    12288:ixfMNAGE3qOh/EcvseSdNZo9KDictCHTC0kX7qj8DBTuLTtuZTUJ:i9GVE3qOh/zxqG9lkCHo7qQtThZTU

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

amechi.duckdns.org:4190

Mutex

2a0a9f29-2b47-4a8a-bba0-73bd2bfb466e

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    amechi.duckdns.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-11-27T10:27:04.358793536Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4190

  • default_group

    EYPPPP

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    2a0a9f29-2b47-4a8a-bba0-73bd2bfb466e

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    amechi.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe
    "C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kgiHOQFWsi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE724.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3024
    • C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe
      "{path}"
      2⤵
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1316

Network

  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    68.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • flag-us
    DNS
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    Remote address:
    8.8.8.8:53
    Request
    amechi.duckdns.org
    IN A
    Response
    amechi.duckdns.org
    IN A
    45.128.36.178
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 45.128.36.178:4190
    amechi.duckdns.org
    PROOF OF PAYMENT.exe
    208 B
    4
  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    256 B
    272 B
    4
    4

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    128 B
    144 B
    2
    2

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

  • 8.8.8.8:53
    68.209.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    68.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    256 B
    272 B
    4
    4

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    64 B
    80 B
    1
    1

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    128 B
    160 B
    2
    2

    DNS Request

    amechi.duckdns.org

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

    DNS Response

    45.128.36.178

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    64 B
    80 B
    1
    1

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

  • 8.8.8.8:53
    amechi.duckdns.org
    dns
    PROOF OF PAYMENT.exe
    64 B
    80 B
    1
    1

    DNS Request

    amechi.duckdns.org

    DNS Response

    45.128.36.178

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpE724.tmp

    Filesize

    1KB

    MD5

    671a6c030de33d5123075040da9b753d

    SHA1

    36d41c9e2eef3e5db0ca3776f5d13fbd7bdef3b8

    SHA256

    86c70796fe0c7508d604d5cd229dd76f764f96a8ab5e39a3903560c1d7e0538b

    SHA512

    b21f0359fd676e485245849966c81c77cbf808a5d0092fc099a87d9fbf25d5dbba33402ff7f1149d7f87311829775c9df7a600b96e0955b4e8002eec9c382e1b

  • memory/1316-25-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/1316-24-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/1316-23-0x0000000006450000-0x000000000645A000-memory.dmp

    Filesize

    40KB

  • memory/1316-22-0x0000000006330000-0x000000000634E000-memory.dmp

    Filesize

    120KB

  • memory/1316-21-0x0000000005690000-0x000000000569A000-memory.dmp

    Filesize

    40KB

  • memory/1316-18-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/1316-16-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/1316-14-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/4216-4-0x0000000004C30000-0x0000000004C3A000-memory.dmp

    Filesize

    40KB

  • memory/4216-10-0x0000000008AD0000-0x0000000008B64000-memory.dmp

    Filesize

    592KB

  • memory/4216-9-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4216-8-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

    Filesize

    4KB

  • memory/4216-7-0x0000000004D30000-0x0000000004D38000-memory.dmp

    Filesize

    32KB

  • memory/4216-17-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4216-6-0x00000000086E0000-0x000000000877C000-memory.dmp

    Filesize

    624KB

  • memory/4216-0-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

    Filesize

    4KB

  • memory/4216-5-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4216-3-0x0000000004B90000-0x0000000004C22000-memory.dmp

    Filesize

    584KB

  • memory/4216-2-0x0000000005140000-0x00000000056E4000-memory.dmp

    Filesize

    5.6MB

  • memory/4216-1-0x0000000000110000-0x00000000001D6000-memory.dmp

    Filesize

    792KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.