Overview

overview

10

Static

static

Document.1...ml.exe

windows7_x64

10

Document.1...ml.exe

windows10_x64

10

Analysis

  • max time kernel
    13s
  • max time network
    178s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    22-07-2021 10:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document.1-xml.eml.exe

  • Size

    260KB

  • MD5

    4d48e3cbfc19b5729b6c7a968a957805

  • SHA1

    4863e913b2e5709d9ed8c5937ae046e2edeee152

  • SHA256

    45cf5d850ca6806fd9b55ef35a2ebe8aa2d9b724b67f96eac270c44d1a85e810

  • SHA512

    d77c98a1a9a15c4bbd63ed573043634d6af46955abad40446a22b78f0b821445c63d6ea02a604a0388d6adbe460c8ba8178d9af8e3735dde3ac28f3435e269c2

Score
10/10
nanocorekeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

194.5.98.136:2888

Mutex

ec07ca6b-08b1-47be-b65b-f4ac1e815e5d

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-05-01T18:15:37.116401936Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    2888

  • default_group

    alozzzz

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    ec07ca6b-08b1-47be-b65b-f4ac1e815e5d

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    194.5.98.136

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • Nirsoft 3 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe
    "C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe"
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe
        "C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe"
        2⤵
          PID:868
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp114F.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:524
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1517.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:1492
          • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
            "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\rsvnqeug.mb5"
            3⤵
              PID:1016
            • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
              "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\eu2pfcso.lap"
              3⤵
                PID:684

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Scripting

          1
          T1064

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Scripting

          1
          T1064

          Credential Access

          Discovery

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\eu2pfcso.lap
            MD5

            919e671c3d5959a91ef2d4c377d2b2ff

            SHA1

            b1202b19512bbd390d3d5164792501c87bb42c41

            SHA256

            d2e079df7cf6388315368ba79bf099ad2ff5428af51bf5abf2d99a2d7c5eb651

            SHA512

            f3298256372beab8efe81b2e08d3b3869281f625de1ee13189c6b95eb2134d223df6f64cc9e490dd6b52a53aa936adc17bd5dfe4e50ee0fe420f3ebae276381c

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\rsvnqeug.mb5
            MD5

            69b2a2e17e78d24abee9f1de2f04811a

            SHA1

            d19c109704e83876ab3527457f9418a7d053aa33

            SHA256

            1b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd

            SHA512

            eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmp114F.tmp
            MD5

            9eae5cb387235d7c0613d27d9b9a0a8f

            SHA1

            1f443957fa52408653b102c7774aea428d1aca3b

            SHA256

            4fa977313336a72788282e243ecf0819827367552f67d80d33d4ff98d4744295

            SHA512

            970922ebf841239c5ca290004819f600393307e4d57955e730f9b4135435126ce40a375c12c983d0411c0d5beb0685e86e633b69eb5a9e7d1ad35fc0c2dcf46a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmp1517.tmp
            MD5

            a9af285136db016a568e4a53208f21d0

            SHA1

            e1afef2b7ee8ae945353315daa19a15574b435b7

            SHA256

            7dce876e35550f4a5b8ce8a8bbab3b0ccd7c5b8660f9db4b832466b77e3a8b7c

            SHA512

            80a1f5e463a87cddc0f66336e2dc4262daf98984c6f6c662c3615d615ebe7c58677c3d694edb3bd7816ccee969aae967c7efe8526ba423f274ac1210c0c8bd6e

            Download Submit
          • memory/524-68-0x0000000000000000-mapping.dmp
            Download
          • memory/684-81-0x0000000000400000-0x0000000000453000-memory.dmp
            Filesize

            332KB

            Download
          • memory/684-78-0x0000000000442628-mapping.dmp
            Download
          • memory/684-77-0x0000000000400000-0x0000000000453000-memory.dmp
            Filesize

            332KB

            Download
          • memory/868-64-0x0000000000400000-0x0000000000438000-memory.dmp
            Filesize

            224KB

            Download
          • memory/868-67-0x0000000001FE0000-0x0000000001FE1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/868-65-0x000000000041E792-mapping.dmp
            Download
          • memory/1016-72-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

            Download
          • memory/1016-73-0x0000000000411654-mapping.dmp
            Download
          • memory/1016-75-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

            Download
          • memory/1208-60-0x0000000075C71000-0x0000000075C73000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1208-63-0x0000000000840000-0x0000000000875000-memory.dmp
            Filesize

            212KB

            Download
          • memory/1208-62-0x0000000000A01000-0x0000000000A02000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1208-61-0x0000000000A00000-0x0000000000A01000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1492-70-0x0000000000000000-mapping.dmp
            Download