Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe
Resource
win10v2004-20241007-en
General
-
Target
e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe
-
Size
416KB
-
MD5
7733ac590c5acfdd2d38ccff32e74850
-
SHA1
2bed655b8239f732cae231eac56aaa62d22aae67
-
SHA256
e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15
-
SHA512
bebbd9c6be29344b9f0aabec73b88b665c84bb6a6d8ff9a0dbbbc96318e9140c59b7f68390089ef2a19ea5e933e46edc512a4f561e8cc894b2012b200d88730b
-
SSDEEP
6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RU7k:ITNYrnE3bm/CiejewY5vH
Malware Config
Extracted
nanocore
1.2.2.0
4af74541-e3f1-469c-8af7-efe4071b81cf
-
activate_away_mode
false
-
backup_connection_host
178.32.224.116
- backup_dns_server
-
buffer_size
65535
-
build_time
2018-07-28T12:59:38.488799236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
46218
-
default_group
tourex
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4af74541-e3f1-469c-8af7-efe4071b81cf
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Executes dropped EXE 1 IoCs
pid Process 2744 ximo2ubzn1i.exe -
Loads dropped DLL 1 IoCs
pid Process 1228 e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe" e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA regasm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2744 set thread context of 2852 2744 ximo2ubzn1i.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ximo2ubzn1i.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2852 regasm.exe 2852 regasm.exe 2852 regasm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2852 regasm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2852 regasm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2744 1228 e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe 30 PID 1228 wrote to memory of 2744 1228 e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe 30 PID 1228 wrote to memory of 2744 1228 e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe 30 PID 1228 wrote to memory of 2744 1228 e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe 30 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31 PID 2744 wrote to memory of 2852 2744 ximo2ubzn1i.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe"C:\Users\Admin\AppData\Local\Temp\e4bc39fba3615dfb69368e4c05c6c64d788f38b55aa17894054f9028e1d32f15N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD5d99e27245030d3299ae33fdb58a53015
SHA18c438f0f7c9f73bc13f80dc2babba3694e5e24d3
SHA25674a8f221c8e399571e9d13adcf68cdf568c1af3903571518db9609d72ea3b9be
SHA51252573d37bd4beea51c8c3f05540dd9ab982c6b38dc4d32e659b753fd9e621f87dc297a59d2ef906c8d6bdf7f318d2444d3548de01f12a9caeae4091fa5327894