Analysis Overview
SHA256
dceafff25f376bd3883f15c500fbfe369b45821fdbb0e34caa0bc715f5e34ad2
Threat Level: Known bad
The file dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe was found to be: Known bad.
Malicious Activity Summary
NanoCore
Nanocore family
Checks computer location settings
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-12 05:36
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-12 05:36
Reported
2024-11-12 05:38
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
NanoCore
Nanocore family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3220 set thread context of 4284 | N/A | C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe
"C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\adwOuvuzR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E1.tmp"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fredrchmn.duckdns.org | udp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 8.8.8.8:53 | 26.69.169.192.in-addr.arpa | udp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fredrchmn.duckdns.org | udp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
Files
memory/3220-0-0x00000000751CE000-0x00000000751CF000-memory.dmp
memory/3220-1-0x0000000000A80000-0x0000000000B30000-memory.dmp
memory/3220-2-0x0000000005A90000-0x0000000006034000-memory.dmp
memory/3220-3-0x0000000005580000-0x0000000005612000-memory.dmp
memory/3220-5-0x00000000751C0000-0x0000000075970000-memory.dmp
memory/3220-4-0x00000000054F0000-0x00000000054FA000-memory.dmp
memory/3220-6-0x0000000005650000-0x0000000005658000-memory.dmp
memory/3220-7-0x00000000059E0000-0x0000000005A7C000-memory.dmp
memory/3220-8-0x00000000751CE000-0x00000000751CF000-memory.dmp
memory/3220-9-0x00000000751C0000-0x0000000075970000-memory.dmp
memory/3220-10-0x00000000068B0000-0x0000000006958000-memory.dmp
memory/3220-11-0x0000000006AA0000-0x0000000006AF8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp6E1.tmp
| MD5 | 0aeaeeef74b1a4d457fd6b7c8cac8731 |
| SHA1 | fa4043b17ffef802ae54eae741cbdc73002c122b |
| SHA256 | 6041e964a54d11aefa866365543cafce0f41b0b6f5e98ab32fde0a5a61dd1ccf |
| SHA512 | 725996c6782f948f390f3b61b4e26b85393646fe75ad4979e9dbc66a95941c123c6f21412d0d0fdde2ef90d36383934fbe7a91095b55e510a3bfc87ee34d9c18 |
memory/4284-15-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3220-17-0x00000000751C0000-0x0000000075970000-memory.dmp
memory/4284-18-0x00000000751C0000-0x0000000075970000-memory.dmp
memory/4284-19-0x00000000751C0000-0x0000000075970000-memory.dmp
memory/4284-21-0x0000000005980000-0x000000000598A000-memory.dmp
memory/4284-22-0x0000000005BF0000-0x0000000005C0E000-memory.dmp
memory/4284-23-0x0000000005C30000-0x0000000005C3A000-memory.dmp
memory/4284-24-0x00000000751C0000-0x0000000075970000-memory.dmp
memory/4284-25-0x00000000751C0000-0x0000000075970000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-12 05:36
Reported
2024-11-12 05:38
Platform
win7-20241010-en
Max time kernel
149s
Max time network
149s
Command Line
Signatures
NanoCore
Nanocore family
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2880 set thread context of 2740 | N/A | C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe
"C:\Users\Admin\AppData\Local\Temp\dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\adwOuvuzR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD9BC.tmp"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | fredrchmn.duckdns.org | udp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 8.8.8.8:53 | fredrchmn.duckdns.org | udp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | fredrchmn.duckdns.org | tcp |
| US | 192.169.69.26:7788 | tcp |
Files
memory/2880-0-0x0000000073DCE000-0x0000000073DCF000-memory.dmp
memory/2880-1-0x0000000001300000-0x00000000013B0000-memory.dmp
memory/2880-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2880-3-0x00000000003A0000-0x00000000003A8000-memory.dmp
memory/2880-4-0x0000000073DCE000-0x0000000073DCF000-memory.dmp
memory/2880-5-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2880-6-0x0000000004E10000-0x0000000004EB8000-memory.dmp
memory/2880-7-0x0000000005100000-0x0000000005158000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpD9BC.tmp
| MD5 | 0ffd81f6b70e9b24a5bf044b98442b77 |
| SHA1 | bb98efb192c37c5149df3020493527dc72718be8 |
| SHA256 | 576887a7b9237155e036175c7be47be03ad8b6ef267fa689d799509c1f7ce1d7 |
| SHA512 | b1ddb2b53480078b77b78b4406aa2d664dbdb5216fce1b1cceeb98e552622882d907b93b8731258bc97826d2d1609a7040d87e54cb9a2797d3388d84e48f4e76 |
memory/2740-12-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-11-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-19-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2740-23-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-21-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-15-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-13-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2740-24-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2880-25-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2740-26-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2740-28-0x00000000005E0000-0x00000000005EA000-memory.dmp
memory/2740-29-0x0000000000890000-0x00000000008AE000-memory.dmp
memory/2740-30-0x00000000005F0000-0x00000000005FA000-memory.dmp
memory/2740-31-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2740-32-0x0000000073DC0000-0x00000000744AE000-memory.dmp