Overview

overview

10

Static

static

SecuriteIn...41.exe

windows7_x64

10

SecuriteIn...41.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-01-2021 11:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe

  • Size

    763KB

  • MD5

    81956bb4f67d790e13cfd18f4cdd779b

  • SHA1

    0bf781a6c1434d789f963d5dc76fdeae28cb01b4

  • SHA256

    f2b321a162040b2990fe549349f00c9a60c2827ea0e82486f9c2c785d14d1462

  • SHA512

    a6efb7cd565b2da0811a79c8eeab2d4dc470296a7eccb4badb21ddaf1add94ef3f2f02e2223212a19564137b08919434d65e8be99f1779e9dd475eb11443e9d7

Score
10/10
nanocoreevasionkeyloggerpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

:4009

127.0.0.1:4009
Mutex

b4dbb526-0da4-4453-8602-b00f5f7a8285

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-11-06T12:52:22.794043236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4009

  • default_group

    HELP

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    b4dbb526-0da4-4453-8602-b00f5f7a8285

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

  • primary_dns_server

    4009

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TrXHdHpWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4111.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2756
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe"
      2⤵
        PID:588
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe"
        2⤵
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4028

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.GenericKDZ.72687.31999.25241.exe.log
      MD5

      c3cc52ccca9ff2b6fa8d267fc350ca6b

      SHA1

      a68d4028333296d222e4afd75dea36fdc98d05f3

      SHA256

      3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

      SHA512

      b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\tmp4111.tmp
      MD5

      9bda20a11b01431a183132c7aa49dbc7

      SHA1

      7e81b6e96cac3d6036285b79b8b69372fefa2e37

      SHA256

      efcf5767bf3bb8d8eefa505113c79e2a9b99d76493b7b0490abea9ba57ec0288

      SHA512

      7d3653567f394803ef4e782c3f8f8aad972fc9df331124fbcdd535788440a3e56ed7a3fed73803bc08b374af2e11b11e936be151d5440c10597dbe9c5c20ac84

      Download Submit
    • memory/2756-12-0x0000000000000000-mapping.dmp
      Download
    • memory/3084-11-0x0000000001520000-0x0000000001587000-memory.dmp
      Filesize

      412KB

      Download
    • memory/3084-5-0x0000000005C30000-0x0000000005C31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3084-8-0x0000000005780000-0x0000000005781000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3084-9-0x0000000005AF0000-0x0000000005AF1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3084-10-0x0000000005AD0000-0x0000000005AD3000-memory.dmp
      Filesize

      12KB

      Download
    • memory/3084-2-0x0000000073940000-0x000000007402E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3084-6-0x00000000057D0000-0x00000000057D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3084-7-0x0000000005870000-0x0000000005871000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3084-3-0x0000000000D40000-0x0000000000D41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4028-15-0x000000000041E792-mapping.dmp
      Download
    • memory/4028-14-0x0000000000400000-0x0000000000438000-memory.dmp
      Filesize

      224KB

      Download
    • memory/4028-17-0x0000000073940000-0x000000007402E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/4028-24-0x00000000056A0000-0x00000000056A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4028-25-0x0000000003260000-0x0000000003265000-memory.dmp
      Filesize

      20KB

      Download
    • memory/4028-26-0x0000000003270000-0x0000000003289000-memory.dmp
      Filesize

      100KB

      Download
    • memory/4028-27-0x0000000005520000-0x0000000005523000-memory.dmp
      Filesize

      12KB

      Download