Analysis
- max time kernel
140s - max time network
145s - platform
windows10_x64 - resource
win10v200722 - submitted
01/10/2020, 06:36
General
- Target 3rd-stage.exe
- Size 444KB
- Sample201001-9q4mc4ttqe
- SHA256 e3e2eb5f82a7580c067c4e4c41edc947a978a9e74ecc39e875fc3093d2c3cb66
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
isiefinama.duckdns.org:2202
-
5d21d362-f8b6-4040-a9fb-ed85d0f6865f
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-03T15:10:54.560625236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2202
-
default_group
Crosser
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5d21d362-f8b6-4040-a9fb-ed85d0f6865f
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
isiefinama.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3rd-stage.exe"C:\Users\Admin\AppData\Local\Temp\3rd-stage.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3rd-stage.exe"C:\Users\Admin\AppData\Local\Temp\3rd-stage.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 10402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3288-0-0x0000000073950000-0x000000007403E000-memory.dmp
memory/3288-1-0x0000000000010000-0x0000000000011000-memory.dmp
memory/3288-3-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/3288-4-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/3760-7-0x0000000073950000-0x000000007403E000-memory.dmp
memory/3760-5-0x0000000000400000-0x000000000045E000-memory.dmp
memory/3760-11-0x0000000005650000-0x0000000005651000-memory.dmp
memory/3760-14-0x0000000005620000-0x0000000005621000-memory.dmp
memory/3760-37-0x00000000057E0000-0x00000000057E5000-memory.dmp
memory/3760-65-0x0000000005C40000-0x0000000005C59000-memory.dmp
memory/3760-70-0x00000000059E0000-0x00000000059E3000-memory.dmp
memory/3880-13-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/3880-16-0x00000000050A0000-0x00000000050A1000-memory.dmp