Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 19:40
Static task
static1
Behavioral task
behavioral1
Sample
wire transfer2.exe
Resource
win7-20240419-en
General
-
Target
wire transfer2.exe
-
Size
636KB
-
MD5
98edee6a736fd329af602c895531f560
-
SHA1
5fece25803bdcb0f283fe479c70fdcd06042421c
-
SHA256
bf1f247b36adba6085a563ea0d78d2a96cb4c523cbcbe2842a19dd214a0e655a
-
SHA512
f52986e5916f1f3bd1efb8d7f0f7aa79da8818adbacc8f48e1eb41c3571f5ec1e8289ff7f2c42f8e45a49eaef58bd2a68d3e27a9f6fc930f432ab7067795ecc3
-
SSDEEP
12288:BUSME+vHKKB9YP2BFc+2zgjSrN5bkab6zp8cDYd5AynZNE7y9toRSuFcUrlqk:5cfKLv+2zgkiVCqCvZNdoEuFcUQk
Malware Config
Extracted
nanocore
1.2.2.0
amechi.duckdns.org:4190
3b3fb7d2-e471-4b8f-930b-90a0b4d21b99
-
activate_away_mode
true
-
backup_connection_host
amechi.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-30T09:04:45.886194136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4190
-
default_group
PRINCE SA HANDWORK
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3b3fb7d2-e471-4b8f-930b-90a0b4d21b99
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
amechi.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wire transfer2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation wire transfer2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wire transfer2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" wire transfer2.exe -
Processes:
wire transfer2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wire transfer2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wire transfer2.exedescription pid process target process PID 5000 set thread context of 3636 5000 wire transfer2.exe wire transfer2.exe -
Drops file in Program Files directory 2 IoCs
Processes:
wire transfer2.exedescription ioc process File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe wire transfer2.exe File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe wire transfer2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
wire transfer2.exewire transfer2.exepid process 5000 wire transfer2.exe 5000 wire transfer2.exe 3636 wire transfer2.exe 3636 wire transfer2.exe 3636 wire transfer2.exe 3636 wire transfer2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wire transfer2.exepid process 3636 wire transfer2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wire transfer2.exewire transfer2.exedescription pid process Token: SeDebugPrivilege 5000 wire transfer2.exe Token: SeDebugPrivilege 3636 wire transfer2.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wire transfer2.exedescription pid process target process PID 5000 wrote to memory of 5116 5000 wire transfer2.exe schtasks.exe PID 5000 wrote to memory of 5116 5000 wire transfer2.exe schtasks.exe PID 5000 wrote to memory of 5116 5000 wire transfer2.exe schtasks.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe PID 5000 wrote to memory of 3636 5000 wire transfer2.exe wire transfer2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wire transfer2.exe"C:\Users\Admin\AppData\Local\Temp\wire transfer2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AxXDlVIQlS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F92.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\wire transfer2.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2736,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4F92.tmpFilesize
1KB
MD513a9dd6cadb01284639b6f790ca46164
SHA1c4344535ddc3b6286ad21e70036a7350dc2cc025
SHA25669a205ffd1e2773c3d06d83c7b56d3aab081669c225fc848c88f61c9bb1cc097
SHA5120025f77307b491950733c596049a105b155eb23ec9202f4a6312ba413cc034e0841e8dd53a159714a443cac56b851fb4e09ef6f9577199b2d92057aeb439ce24
-
memory/3636-25-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/3636-24-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/3636-23-0x0000000006640000-0x000000000664A000-memory.dmpFilesize
40KB
-
memory/3636-22-0x0000000006510000-0x000000000652E000-memory.dmpFilesize
120KB
-
memory/3636-21-0x0000000005C90000-0x0000000005C9A000-memory.dmpFilesize
40KB
-
memory/3636-18-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/3636-16-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/3636-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5000-5-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/5000-10-0x0000000008360000-0x00000000083EE000-memory.dmpFilesize
568KB
-
memory/5000-9-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/5000-8-0x0000000074ECE000-0x0000000074ECF000-memory.dmpFilesize
4KB
-
memory/5000-7-0x00000000081A0000-0x00000000081B2000-memory.dmpFilesize
72KB
-
memory/5000-17-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/5000-6-0x00000000081C0000-0x000000000825C000-memory.dmpFilesize
624KB
-
memory/5000-0-0x0000000074ECE000-0x0000000074ECF000-memory.dmpFilesize
4KB
-
memory/5000-4-0x0000000005640000-0x000000000564A000-memory.dmpFilesize
40KB
-
memory/5000-3-0x00000000055A0000-0x0000000005632000-memory.dmpFilesize
584KB
-
memory/5000-2-0x0000000005A70000-0x0000000006014000-memory.dmpFilesize
5.6MB
-
memory/5000-1-0x0000000000C20000-0x0000000000CC6000-memory.dmpFilesize
664KB