Analysis

  • max time kernel
    302s
  • max time network
    299s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    19-10-2021 14:52

General

  • Target

    PO-13916654658867654342002.exe

  • Size

    479KB

  • MD5

    6102daa4935e016dea8dc3eec27d2ac1

  • SHA1

    c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca

  • SHA256

    5d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce

  • SHA512

    92d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.157.160.229:60006

neoncorex.duckdns.org:60006

Mutex

1d5c6a3e-60c1-4684-aee7-fbdc0338bfa0

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    neoncorex.duckdns.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-07-29T18:43:26.772131836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    60006

  • default_group

    NANOSHIELD

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    1d5c6a3e-60c1-4684-aee7-fbdc0338bfa0

  • mutex_timeout

    5000

  • prevent_system_sleep

    true

  • primary_connection_host

    185.157.160.229

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342002.exe
    "C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342002.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:3456
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:616
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PO-13916654658867654342002.exe" "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe"
      2⤵
        PID:3764
    • C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
      C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:1768
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:3096
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe" "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe"
          2⤵
            PID:1724
        • C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
          C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
              PID:1420
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2352
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe'" /f
                3⤵
                • Creates scheduled task(s)
                PID:3280
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe" "C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe"
              2⤵
                PID:1820

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Discovery

            System Information Discovery

            2
            T1082

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
              MD5

              c3cc52ccca9ff2b6fa8d267fc350ca6b

              SHA1

              a68d4028333296d222e4afd75dea36fdc98d05f3

              SHA256

              3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

              SHA512

              b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dllinstallprint.exe.log
              MD5

              7ffb997d789655f20c977dd932150653

              SHA1

              ddea3eb28fe069e99327ed7ac3ad089dcae3fc59

              SHA256

              d6532c4017d9cb6d1c74dcec7a255944c4099d68de37d8c88f0f72bf232a7ad3

              SHA512

              15801c094a49d541de42ebeee41d8f2bf9f16e5b443cdfe221ea1d8e83d23882bb897e8757f52fd43f8c403eea847f893709c21110930d2856c2a00bfe1425c2

            • C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
              MD5

              6102daa4935e016dea8dc3eec27d2ac1

              SHA1

              c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca

              SHA256

              5d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce

              SHA512

              92d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51

            • C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
              MD5

              6102daa4935e016dea8dc3eec27d2ac1

              SHA1

              c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca

              SHA256

              5d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce

              SHA512

              92d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51

            • C:\Users\Admin\AppData\Roaming\dllinstallprint\dllinstallprint.exe
              MD5

              6102daa4935e016dea8dc3eec27d2ac1

              SHA1

              c5320bd4d54b856aa90bc7a92ca9ce5dc22e70ca

              SHA256

              5d192cc1e5d9569479192b9ca7147953428158484ab4f5c0480ad220688fbfce

              SHA512

              92d0683cc73ea1479426a5869cc66be21b28482069af8c8fceb69ea183d978d5f600323011c7944a1b618b11e3a56d4371aaf8dcc3238098c4388eccd5115b51

            • memory/616-131-0x0000000000000000-mapping.dmp
            • memory/1420-177-0x0000000004AC0000-0x0000000004FBE000-memory.dmp
              Filesize

              5.0MB

            • memory/1420-166-0x000000000041E792-mapping.dmp
            • memory/1724-153-0x0000000000000000-mapping.dmp
            • memory/1768-156-0x0000000005470000-0x000000000596E000-memory.dmp
              Filesize

              5.0MB

            • memory/1768-146-0x000000000041E792-mapping.dmp
            • memory/1812-117-0x0000000005940000-0x0000000005941000-memory.dmp
              Filesize

              4KB

            • memory/1812-118-0x0000000005440000-0x0000000005441000-memory.dmp
              Filesize

              4KB

            • memory/1812-119-0x0000000002E90000-0x0000000002E91000-memory.dmp
              Filesize

              4KB

            • memory/1812-120-0x00000000053C0000-0x00000000053C1000-memory.dmp
              Filesize

              4KB

            • memory/1812-115-0x00000000010B0000-0x00000000010B1000-memory.dmp
              Filesize

              4KB

            • memory/1820-174-0x0000000000000000-mapping.dmp
            • memory/2088-152-0x0000000000000000-mapping.dmp
            • memory/2200-139-0x0000000000070000-0x0000000000071000-memory.dmp
              Filesize

              4KB

            • memory/2200-144-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
              Filesize

              4KB

            • memory/2352-173-0x0000000000000000-mapping.dmp
            • memory/2896-129-0x0000000000000000-mapping.dmp
            • memory/3096-154-0x0000000000000000-mapping.dmp
            • memory/3280-176-0x0000000000000000-mapping.dmp
            • memory/3456-122-0x000000000041E792-mapping.dmp
            • memory/3456-127-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
              Filesize

              4KB

            • memory/3456-121-0x0000000000400000-0x0000000000438000-memory.dmp
              Filesize

              224KB

            • memory/3456-135-0x0000000004C50000-0x0000000004C51000-memory.dmp
              Filesize

              4KB

            • memory/3456-136-0x0000000004C53000-0x0000000004C55000-memory.dmp
              Filesize

              8KB

            • memory/3456-134-0x0000000005AE0000-0x0000000005AE3000-memory.dmp
              Filesize

              12KB

            • memory/3456-133-0x0000000005270000-0x0000000005289000-memory.dmp
              Filesize

              100KB

            • memory/3456-132-0x0000000005040000-0x0000000005045000-memory.dmp
              Filesize

              20KB

            • memory/3604-164-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
              Filesize

              4KB

            • memory/3764-130-0x0000000000000000-mapping.dmp