Overview

overview

10

Static

static

Document.1...ml.exe

windows7_x64

10

Document.1...ml.exe

windows10_x64

10

Analysis

  • max time kernel
    12s
  • max time network
    165s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    22-07-2021 10:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document.1-xml.eml.exe

  • Size

    260KB

  • MD5

    4d48e3cbfc19b5729b6c7a968a957805

  • SHA1

    4863e913b2e5709d9ed8c5937ae046e2edeee152

  • SHA256

    45cf5d850ca6806fd9b55ef35a2ebe8aa2d9b724b67f96eac270c44d1a85e810

  • SHA512

    d77c98a1a9a15c4bbd63ed573043634d6af46955abad40446a22b78f0b821445c63d6ea02a604a0388d6adbe460c8ba8178d9af8e3735dde3ac28f3435e269c2

Score
10/10
nanocorekeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

194.5.98.136:2888

Mutex

ec07ca6b-08b1-47be-b65b-f4ac1e815e5d

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-05-01T18:15:37.116401936Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    2888

  • default_group

    alozzzz

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    ec07ca6b-08b1-47be-b65b-f4ac1e815e5d

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    194.5.98.136

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • Nirsoft 3 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe
    "C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe"
    1⤵
      PID:3680
      • C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe
        "C:\Users\Admin\AppData\Local\Temp\Document.1-xml.eml.exe"
        2⤵
          PID:2972
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "ISS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA03D.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:680
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "ISS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA128.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:1604
          • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
            "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\jhmcmh1j.j2g"
            3⤵
              PID:3992
            • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
              "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\0preskez.td2"
              3⤵
                PID:2352

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Scripting

          1
          T1064

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Scripting

          1
          T1064

          Credential Access

          Discovery

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Document.1-xml.eml.exe.log
            MD5

            b3ac9d09e3a47d5fd00c37e075a70ecb

            SHA1

            ad14e6d0e07b00bd10d77a06d68841b20675680b

            SHA256

            7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432

            SHA512

            09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\0preskez.td2
            MD5

            02524418240369b25b988e9884cd1c54

            SHA1

            42a33322d952edf6d8431d4cd788bbc863d2b890

            SHA256

            80b2a0874c2f734dfe1196d7ae2a7bc6ccb30df2d9281513ac33edc529a71a37

            SHA512

            7c5bbe911f7f0b072d6fdb89ea5759655c2b5cf9ebfddff8f2f67f956141b8ed3697ab0504f60c3992849afbbc79434043a6c04d7cf6ddd958e23354fd3a698f

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\jhmcmh1j.j2g
            MD5

            69b2a2e17e78d24abee9f1de2f04811a

            SHA1

            d19c109704e83876ab3527457f9418a7d053aa33

            SHA256

            1b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd

            SHA512

            eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmpA03D.tmp
            MD5

            9eae5cb387235d7c0613d27d9b9a0a8f

            SHA1

            1f443957fa52408653b102c7774aea428d1aca3b

            SHA256

            4fa977313336a72788282e243ecf0819827367552f67d80d33d4ff98d4744295

            SHA512

            970922ebf841239c5ca290004819f600393307e4d57955e730f9b4135435126ce40a375c12c983d0411c0d5beb0685e86e633b69eb5a9e7d1ad35fc0c2dcf46a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmpA128.tmp
            MD5

            ea7095fa975a5ac043c9de2899ce61d0

            SHA1

            ba4e21d0728fb1b4b87006c2e8ceb6109c9046a3

            SHA256

            5a1ba7b1b91e0bb7aedcfa82dc687972abb31f72ae1613ac586938ef0843f30f

            SHA512

            b52c8f1b58f263a3d1ad1ef9939167853a5f55033d9ad8976130174c7118407711a0703266c7d2d542bc2ca8119f875e35cc791b9dd70ef83b5310ac1e7cd1cb

            Download Submit
          • memory/680-120-0x0000000000000000-mapping.dmp
            Download
          • memory/1604-122-0x0000000000000000-mapping.dmp
            Download
          • memory/2352-130-0x0000000000400000-0x0000000000453000-memory.dmp
            Filesize

            332KB

            Download
          • memory/2352-128-0x0000000000400000-0x0000000000453000-memory.dmp
            Filesize

            332KB

            Download
          • memory/2352-129-0x0000000000442628-mapping.dmp
            Download
          • memory/2972-119-0x0000000000960000-0x0000000000961000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2972-116-0x000000000041E792-mapping.dmp
            Download
          • memory/2972-115-0x0000000000400000-0x0000000000438000-memory.dmp
            Filesize

            224KB

            Download
          • memory/3680-118-0x0000000004B30000-0x0000000004B65000-memory.dmp
            Filesize

            212KB

            Download
          • memory/3680-114-0x00000000025E0000-0x00000000025E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3992-126-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

            Download
          • memory/3992-125-0x0000000000411654-mapping.dmp
            Download
          • memory/3992-124-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

            Download