Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    18-10-2021 20:10

General

  • Target

    70cb56c6c5c12806d8ab9ec9cb9f9721.exe

  • Size

    1.1MB

  • MD5

    70cb56c6c5c12806d8ab9ec9cb9f9721

  • SHA1

    9f112cd0766ee8fc0cb64506de3549aad9d75625

  • SHA256

    4838766d4fa1bd049a8d49f32865f1ef93a56b0ffd5f5fe4fb3401e6329ade0c

  • SHA512

    03725f2203b53e0d3bb0ed491929f3c6bb632712ecde91a8c312cad61598ef7ee64ef6cb87a5157381a3dba138a7dc5a1957707bcbdb1bd52a57c8249d80cd60

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

ezeani.duckdns.org:8338

194.5.98.48:8338

Mutex

d015a44c-6cf4-4669-a736-929e0fa74f7d

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    194.5.98.48

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-07-30T11:54:13.478924636Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    8338

  • default_group

    OCT

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    d015a44c-6cf4-4669-a736-929e0fa74f7d

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    ezeani.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70cb56c6c5c12806d8ab9ec9cb9f9721.exe
    "C:\Users\Admin\AppData\Local\Temp\70cb56c6c5c12806d8ab9ec9cb9f9721.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Users\Admin\00902944\fmgmfohkw.pif
      "C:\Users\Admin\00902944\fmgmfohkw.pif" smjodro.ubd
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "SMTP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFBB.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:2648

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\00902944\fmgmfohkw.pif
    MD5

    8e699954f6b5d64683412cc560938507

    SHA1

    8ca6708b0f158eacce3ac28b23c23ed42c168c29

    SHA256

    c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40

    SHA512

    13035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02

  • C:\Users\Admin\00902944\fmgmfohkw.pif
    MD5

    8e699954f6b5d64683412cc560938507

    SHA1

    8ca6708b0f158eacce3ac28b23c23ed42c168c29

    SHA256

    c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40

    SHA512

    13035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02

  • C:\Users\Admin\00902944\mihirbsn.swj
    MD5

    2471d4f94b2d7c5eae622064ef6bd072

    SHA1

    3b5e649b32e5b10ddd33b1785141e3d682ea11b7

    SHA256

    8ec8b0de14d6fa2a08e2c9fc8bae1a1d4ca00e5c4948b02f0c56105a8252af86

    SHA512

    e5cad0a00b306f9b273d21d505ddfe1d0fd6f0840110508186085dcfb0c6aff8b5b1cf2c2e8bded1adc58418d960ca40e7bfbfc309f58a0292a45fd3d113461c

  • C:\Users\Admin\00902944\smjodro.ubd
    MD5

    26ae67ecd17c9c7bbbda7d1343975991

    SHA1

    b6935195fc15be693ec2bfc7f509a646c22dd53a

    SHA256

    92b478bb54d9c9349a961b053313299b8199624800f5b7610c214b6e23fb7d68

    SHA512

    e13a1b373191cf25d66e655c52d0d18989d5924074693259c1c6ab2173345e6b1618972e66db2b00f2f5af29315145330a192bb453e298a09d1b33f782c911d2

  • C:\Users\Admin\00902944\tqbinrnv.dll
    MD5

    0d34d3d5ccffb912ab9a30b282691dfc

    SHA1

    b5a6851ebf05b2a27e2e76288b694caa041fc579

    SHA256

    57d4ce6b51ebe7600527cbe47b3d35024472089cbce4d77d4370386b1b955249

    SHA512

    7da8e7f956e31474579c5eb2085c61bf88a97406991903a6ccbd1323640c8a983d1e97f9d69d74739f417219c15cb1f9068fa3c970ee5a8cd0fb1936575d8d89

  • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    MD5

    0e06054beb13192588e745ee63a84173

    SHA1

    30b7d4d1277bafd04a83779fd566a1f834a8d113

    SHA256

    c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

    SHA512

    251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

  • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    MD5

    0e06054beb13192588e745ee63a84173

    SHA1

    30b7d4d1277bafd04a83779fd566a1f834a8d113

    SHA256

    c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

    SHA512

    251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

  • C:\Users\Admin\AppData\Local\Temp\tmpFBB.tmp
    MD5

    95aceabc58acad5d73372b0966ee1b35

    SHA1

    2293b7ad4793cf574b1a5220e85f329b5601040a

    SHA256

    8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4

    SHA512

    00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74

  • memory/1592-115-0x0000000000000000-mapping.dmp
  • memory/2648-132-0x0000000000000000-mapping.dmp
  • memory/3596-127-0x0000000005750000-0x0000000005751000-memory.dmp
    Filesize

    4KB

  • memory/3596-128-0x0000000005250000-0x0000000005251000-memory.dmp
    Filesize

    4KB

  • memory/3596-129-0x00000000052F0000-0x00000000052F1000-memory.dmp
    Filesize

    4KB

  • memory/3596-130-0x0000000005250000-0x000000000574E000-memory.dmp
    Filesize

    5.0MB

  • memory/3596-131-0x00000000051F0000-0x00000000051F1000-memory.dmp
    Filesize

    4KB

  • memory/3596-122-0x000000000051E792-mapping.dmp
  • memory/3596-121-0x0000000000500000-0x0000000000C48000-memory.dmp
    Filesize

    7.3MB

  • memory/3596-134-0x00000000054C0000-0x00000000054C5000-memory.dmp
    Filesize

    20KB

  • memory/3596-135-0x00000000054D0000-0x00000000054E9000-memory.dmp
    Filesize

    100KB

  • memory/3596-136-0x0000000005720000-0x0000000005723000-memory.dmp
    Filesize

    12KB