Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 04:24
Static task
static1
Behavioral task
behavioral1
Sample
691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe
Resource
win7-20240903-en
General
-
Target
691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe
-
Size
1.3MB
-
MD5
eda1f9271a18bd14c8e3ccc575ef8da0
-
SHA1
704f796328f013f1ac9d2f82104c254bc96b8130
-
SHA256
691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8
-
SHA512
50874d1629809f4e1c3ebf04ddd5303f21ec30e3f4782c398f369cbc048c7fc63af23e59497815325619a650d724270d498ffbb8feb0a1f11055ab603f8073b1
-
SSDEEP
24576:gAHnh+eWsN3skA4RV1Hom2KXMmHaH04xmQPD5U:Xh+ZkldoPK8YafxU
Malware Config
Extracted
nanocore
1.2.2.0
ponnyhurb.duckdns.org:6290
b3d970d4-fe05-46df-a7e4-b0e6b6eee3ae
-
activate_away_mode
false
-
backup_connection_host
ponnyhurb.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-02-04T04:37:36.694334036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
3992
-
connection_port
6290
-
default_group
ponnyhurb.duckdns.org
-
enable_debug_mode
true
-
gc_threshold
1.0485783e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b3d970d4-fe05-46df-a7e4-b0e6b6eee3ae
-
mutex_timeout
4963
-
prevent_system_sleep
false
-
primary_connection_host
ponnyhurb.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Executes dropped EXE 2 IoCs
pid Process 1036 convertvhd.exe 1596 convertvhd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Monitor = "C:\\Program Files (x86)\\IMAP Monitor\\imapmon.exe" RegAsm.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000019aec-22.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2848 set thread context of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 1036 set thread context of 1764 1036 convertvhd.exe 40 PID 1596 set thread context of 840 1596 convertvhd.exe 45 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\IMAP Monitor\imapmon.exe RegAsm.exe File opened for modification C:\Program Files (x86)\IMAP Monitor\imapmon.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language convertvhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language convertvhd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1908 schtasks.exe 2764 schtasks.exe 2812 schtasks.exe 2588 schtasks.exe 1944 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2648 RegAsm.exe 2648 RegAsm.exe 2648 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2648 RegAsm.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2848 wrote to memory of 2648 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 31 PID 2648 wrote to memory of 2764 2648 RegAsm.exe 32 PID 2648 wrote to memory of 2764 2648 RegAsm.exe 32 PID 2648 wrote to memory of 2764 2648 RegAsm.exe 32 PID 2648 wrote to memory of 2764 2648 RegAsm.exe 32 PID 2648 wrote to memory of 2812 2648 RegAsm.exe 34 PID 2648 wrote to memory of 2812 2648 RegAsm.exe 34 PID 2648 wrote to memory of 2812 2648 RegAsm.exe 34 PID 2648 wrote to memory of 2812 2648 RegAsm.exe 34 PID 2848 wrote to memory of 2588 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 36 PID 2848 wrote to memory of 2588 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 36 PID 2848 wrote to memory of 2588 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 36 PID 2848 wrote to memory of 2588 2848 691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe 36 PID 1584 wrote to memory of 1036 1584 taskeng.exe 39 PID 1584 wrote to memory of 1036 1584 taskeng.exe 39 PID 1584 wrote to memory of 1036 1584 taskeng.exe 39 PID 1584 wrote to memory of 1036 1584 taskeng.exe 39 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1764 1036 convertvhd.exe 40 PID 1036 wrote to memory of 1944 1036 convertvhd.exe 42 PID 1036 wrote to memory of 1944 1036 convertvhd.exe 42 PID 1036 wrote to memory of 1944 1036 convertvhd.exe 42 PID 1036 wrote to memory of 1944 1036 convertvhd.exe 42 PID 1584 wrote to memory of 1596 1584 taskeng.exe 44 PID 1584 wrote to memory of 1596 1584 taskeng.exe 44 PID 1584 wrote to memory of 1596 1584 taskeng.exe 44 PID 1584 wrote to memory of 1596 1584 taskeng.exe 44 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 840 1596 convertvhd.exe 45 PID 1596 wrote to memory of 1908 1596 convertvhd.exe 46 PID 1596 wrote to memory of 1908 1596 convertvhd.exe 46 PID 1596 wrote to memory of 1908 1596 convertvhd.exe 46 PID 1596 wrote to memory of 1908 1596 convertvhd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe"C:\Users\Admin\AppData\Local\Temp\691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "IMAP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDF09.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2764
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "IMAP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDF87.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2812
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn chglogon /tr "C:\Users\Admin\CompatTelRunner\convertvhd.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2588
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1F0534C8-4E2F-4C64-A977-44271DD66E69} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\CompatTelRunner\convertvhd.exeC:\Users\Admin\CompatTelRunner\convertvhd.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1764
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn chglogon /tr "C:\Users\Admin\CompatTelRunner\convertvhd.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
-
C:\Users\Admin\CompatTelRunner\convertvhd.exeC:\Users\Admin\CompatTelRunner\convertvhd.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:840
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn chglogon /tr "C:\Users\Admin\CompatTelRunner\convertvhd.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1908
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
Filesize
1KB
MD5d2d6911d94b06e405e7687a2437eafec
SHA19f28f9e7d8d5179d44ddaa6ca266984ed7521dea
SHA2562dc87169ad53fbdd7abb08f49777cb8fb05adbff4e6f6616b4c89942af8cad0f
SHA512b5983de701ff98e944283a25f1770c1e792d52148dc1671f1d19203f8b9d10b056abcf79a17ca536a5f88ccf52f6445d8f3e75fce628666640ad8bad697dcfd1
-
Filesize
1.3MB
MD55a42e8c0528f065e8b2251641c446212
SHA169d26275510ae204c485651e4886cf39080451cd
SHA25605d8d0918de543911f1acbaa0c13270b03eb248c62781e8b99c32cb44c1db756
SHA51268411d251ecd65b7aa32fac88bbcb00955056768eac6947398337a8f5c3192b4eac2e161a3546ccb237ad8c13054b0c3e796aceebd33b1ea45c5b87a73d7c9da