Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 19:40
Static task
static1
Behavioral task
behavioral1
Sample
wire transfer2.exe
Resource
win7-20240419-en
General
-
Target
wire transfer2.exe
-
Size
636KB
-
MD5
98edee6a736fd329af602c895531f560
-
SHA1
5fece25803bdcb0f283fe479c70fdcd06042421c
-
SHA256
bf1f247b36adba6085a563ea0d78d2a96cb4c523cbcbe2842a19dd214a0e655a
-
SHA512
f52986e5916f1f3bd1efb8d7f0f7aa79da8818adbacc8f48e1eb41c3571f5ec1e8289ff7f2c42f8e45a49eaef58bd2a68d3e27a9f6fc930f432ab7067795ecc3
-
SSDEEP
12288:BUSME+vHKKB9YP2BFc+2zgjSrN5bkab6zp8cDYd5AynZNE7y9toRSuFcUrlqk:5cfKLv+2zgkiVCqCvZNdoEuFcUQk
Malware Config
Extracted
nanocore
1.2.2.0
amechi.duckdns.org:4190
3b3fb7d2-e471-4b8f-930b-90a0b4d21b99
-
activate_away_mode
true
-
backup_connection_host
amechi.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-30T09:04:45.886194136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4190
-
default_group
PRINCE SA HANDWORK
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3b3fb7d2-e471-4b8f-930b-90a0b4d21b99
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
amechi.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wire transfer2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DOS Manager = "C:\\Program Files (x86)\\DOS Manager\\dosmgr.exe" wire transfer2.exe -
Processes:
wire transfer2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wire transfer2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wire transfer2.exedescription pid process target process PID 3012 set thread context of 2580 3012 wire transfer2.exe wire transfer2.exe -
Drops file in Program Files directory 2 IoCs
Processes:
wire transfer2.exedescription ioc process File created C:\Program Files (x86)\DOS Manager\dosmgr.exe wire transfer2.exe File opened for modification C:\Program Files (x86)\DOS Manager\dosmgr.exe wire transfer2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
wire transfer2.exewire transfer2.exepid process 3012 wire transfer2.exe 2580 wire transfer2.exe 2580 wire transfer2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wire transfer2.exepid process 2580 wire transfer2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wire transfer2.exewire transfer2.exedescription pid process Token: SeDebugPrivilege 3012 wire transfer2.exe Token: SeDebugPrivilege 2580 wire transfer2.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
wire transfer2.exedescription pid process target process PID 3012 wrote to memory of 2660 3012 wire transfer2.exe schtasks.exe PID 3012 wrote to memory of 2660 3012 wire transfer2.exe schtasks.exe PID 3012 wrote to memory of 2660 3012 wire transfer2.exe schtasks.exe PID 3012 wrote to memory of 2660 3012 wire transfer2.exe schtasks.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe PID 3012 wrote to memory of 2580 3012 wire transfer2.exe wire transfer2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wire transfer2.exe"C:\Users\Admin\AppData\Local\Temp\wire transfer2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AxXDlVIQlS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8833.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\wire transfer2.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8833.tmpFilesize
1KB
MD5220839c721c6545e6d5a983cf2a67b89
SHA10bc17cfc47638bdfddc4abb10b1c866ce7d2e0d4
SHA256e76356310c4e864aeb4145e1071333abf588bd0965076a50d16a01698d26f53a
SHA5124861ad6e23d31307762301e7023e85d39f3c0f978b8426426d9c587dc52fc5b31e5bcf48627d234c09ecb3fa9e558a87d53007ea3ead39e701bd5cbca36da5cc
-
memory/2580-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2580-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2580-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2580-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2580-29-0x0000000000270000-0x000000000028E000-memory.dmpFilesize
120KB
-
memory/2580-28-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2580-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2580-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2580-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2580-30-0x0000000000290000-0x000000000029A000-memory.dmpFilesize
40KB
-
memory/2580-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3012-3-0x0000000000560000-0x0000000000572000-memory.dmpFilesize
72KB
-
memory/3012-1-0x0000000000EE0000-0x0000000000F86000-memory.dmpFilesize
664KB
-
memory/3012-2-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/3012-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmpFilesize
4KB
-
memory/3012-25-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/3012-6-0x0000000005CC0000-0x0000000005D4E000-memory.dmpFilesize
568KB
-
memory/3012-5-0x0000000073F90000-0x000000007467E000-memory.dmpFilesize
6.9MB
-
memory/3012-4-0x0000000073F9E000-0x0000000073F9F000-memory.dmpFilesize
4KB