Analysis
- max time kernel
42s - max time network
191s - platform
windows7_x64 - resource
win7v20210408 - submitted
13/08/2021, 07:59
General
- Target FE3EC61798741F90F745A0F508F78C33.exe
- Size 11.2MB
- Sample210813-ltd41ghjsn
- SHA256 13e353b5aaf0a49286d0148954759cf4eb844087f28bf0be58f9fe0f8c9df947
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
lordranseierpilot.from-ms.com:4419
-
lordranseier.from-de.com:4419
-
3840f080-c49f-4256-bcbf-eb2fbb38fb91
-
activate_away_mode
true
-
backup_connection_host
lordranseier.from-de.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-14T12:02:11.615420136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4419
-
default_group
Olsders
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3840f080-c49f-4256-bcbf-eb2fbb38fb91
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
lordranseierpilot.from-ms.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- NSIS installer 19 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FE3EC61798741F90F745A0F508F78C33.exe"C:\Users\Admin\AppData\Local\Temp\FE3EC61798741F90F745A0F508F78C33.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\© Cedar Lake Ventures, Inc\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic.exe"C:\Program Files (x86)\© Cedar Lake Ventures, Inc.\Vector Magic 1.15 Portable Win x32+x64 Multi Préactivé\Vector Magic.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Olsders_8.exe"C:\Users\Admin\AppData\Roaming\Olsders_8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Olsders_8.exe"C:\Users\Admin\AppData\Roaming\Olsders_8.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/468-59-0x0000000075051000-0x0000000075053000-memory.dmp
memory/1008-79-0x0000000004420000-0x0000000004453000-memory.dmp
memory/1008-88-0x0000000004560000-0x0000000004563000-memory.dmp
memory/1008-100-0x0000000005B40000-0x0000000005B4F000-memory.dmp
memory/1008-82-0x0000000004571000-0x0000000004572000-memory.dmp
memory/1008-81-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1008-83-0x0000000004572000-0x0000000004573000-memory.dmp
memory/1008-85-0x0000000004574000-0x0000000004575000-memory.dmp
memory/1008-84-0x0000000004573000-0x0000000004574000-memory.dmp
memory/1008-86-0x0000000004550000-0x0000000004555000-memory.dmp
memory/1008-87-0x0000000004E90000-0x0000000004EA9000-memory.dmp
memory/1008-98-0x0000000005AF0000-0x0000000005AFA000-memory.dmp
memory/1008-90-0x0000000005A40000-0x0000000005A55000-memory.dmp
memory/1008-89-0x00000000051B0000-0x00000000051BD000-memory.dmp
memory/1008-93-0x0000000005AA0000-0x0000000005AA7000-memory.dmp
memory/1008-95-0x0000000005AC0000-0x0000000005ACD000-memory.dmp
memory/1008-94-0x0000000005AB0000-0x0000000005AB6000-memory.dmp
memory/1008-96-0x0000000005AD0000-0x0000000005AD9000-memory.dmp
memory/1008-92-0x0000000005A90000-0x0000000005A9C000-memory.dmp
memory/1008-91-0x0000000005A70000-0x0000000005A76000-memory.dmp
memory/1008-97-0x0000000005AE0000-0x0000000005AEF000-memory.dmp
memory/1008-99-0x0000000005B10000-0x0000000005B39000-memory.dmp