Overview

overview

10

Static

static

Yeni sipar...df.exe

windows7_x64

10

Yeni sipar...df.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    25-10-2021 06:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Yeni sipariş _WJO-001, pdf.exe

  • Size

    863KB

  • MD5

    7e0600a5300a5cd87fce0cf4398b578f

  • SHA1

    c52fb2df7f32b3bfadaa923a67e59204bb306429

  • SHA256

    5f86426410b741a6c2c5c3693069520197f2789e490a36c75ace1a4b2792cab6

  • SHA512

    d339f29c09bf5d79b597af2299123c70b3a1be02a325d7254413ce23c4230065d95fa68b21138730d6c0d4ae94717ea7ac9664f58c2bfc8bd7605bb3b43f916a

Score
10/10
nanocorekeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

cashlink.ddns.net:4774

Mutex

c44e3244-c9be-4fcb-8e75-051ae0874277

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-08-04T11:36:08.814072036Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    4774

  • default_group

    MAX LOGS

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    c44e3244-c9be-4fcb-8e75-051ae0874277

  • mutex_timeout

    5000

  • prevent_system_sleep

    true

  • primary_connection_host

    cashlink.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Yeni sipariş _WJO-001, pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Yeni sipariş _WJO-001, pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
      "{path}"
      2⤵
        PID:3928
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
        "{path}"
        2⤵
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3332

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3332-118-0x0000000000400000-0x0000000000438000-memory.dmp
      Filesize

      224KB

      Download
    • memory/3332-119-0x000000000041E792-mapping.dmp
      Download
    • memory/3332-120-0x0000000002970000-0x0000000002971000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3332-121-0x0000000002971000-0x0000000002972000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3496-116-0x0000000002D30000-0x0000000002D31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3496-117-0x0000000002D32000-0x0000000002D34000-memory.dmp
      Filesize

      8KB

      Download