Overview

overview

10

Static

static

SecuriteIn...56.exe

windows7_x64

10

SecuriteIn...56.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    29-01-2021 20:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe

  • Size

    492KB

  • MD5

    03426261381cc6c80f3a5d915facdaad

  • SHA1

    68488e8388ea7e86b96710f053d69c099017ac83

  • SHA256

    e090c7bce1fef0cecdac7f602a187022502187ad05cf140c66f8d85896c8ce73

  • SHA512

    955e0d0189b4946284b9777d1a0f662dde4e95c91a586b757fe60b8604c11fcaee19d0a94e307930cad6e84149851c3a543cfdd90504b3fc4dc14e47cb3aa6bb

Score
10/10
nanocoreevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.140.53.183:83

nazareen12.ddns.net:83
Mutex

d2cffe5f-f975-4612-95e5-321d5f1a67bf

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    nazareen12.ddns.net

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-11-09T21:54:08.609335036Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    83

  • default_group

    A Good Start

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    d2cffe5f-f975-4612-95e5-321d5f1a67bf

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    185.140.53.183

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:296
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe"
      2⤵
        PID:1984
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe"
        2⤵
          PID:1964
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe"
          2⤵
            PID:1972
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe"
            2⤵
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1980
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.45646764.8874.24356.exe"
            2⤵
              PID:2044

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/296-14-0x00000000049B6000-0x00000000049B7000-memory.dmp

            Filesize

            4KB

            Download

          • memory/296-3-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

            Download

          • memory/296-5-0x00000000049A0000-0x00000000049A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/296-6-0x00000000004F0000-0x00000000004F3000-memory.dmp

            Filesize

            12KB

            Download

          • memory/296-15-0x00000000049B7000-0x00000000049B8000-memory.dmp

            Filesize

            4KB

            Download

          • memory/296-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/296-11-0x00000000049A5000-0x00000000049B6000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1980-8-0x000000000041E792-mapping.dmp

            Download

          • memory/1980-25-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1980-9-0x00000000748D0000-0x0000000074FBE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1980-7-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

            Download

          • memory/1980-28-0x0000000001F00000-0x0000000001F0F000-memory.dmp

            Filesize

            60KB

            Download

          • memory/1980-17-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

            Download

          • memory/1980-21-0x00000000005F0000-0x00000000005F5000-memory.dmp

            Filesize

            20KB

            Download

          • memory/1980-22-0x0000000000650000-0x000000000065D000-memory.dmp

            Filesize

            52KB

            Download

          • memory/1980-23-0x0000000000640000-0x000000000064A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1980-24-0x0000000000660000-0x0000000000679000-memory.dmp

            Filesize

            100KB

            Download

          • memory/1980-27-0x00000000006D0000-0x00000000006D3000-memory.dmp

            Filesize

            12KB

            Download

          • memory/2044-13-0x000000000041E792-mapping.dmp

            Download

          • memory/2044-26-0x0000000004D80000-0x0000000004D81000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2044-16-0x00000000748D0000-0x0000000074FBE000-memory.dmp

            Filesize

            6.9MB

            Download