Overview

overview

10

Static

static

Order.exe

windows7_x64

10

Order.exe

windows10_x64

10
General
Target

Order.7z

Size

427KB

Sample

211103-1q6ljacear

Score
10/10
MD5

734e991a781c52b6441526029efa8da1

SHA1

84afee0845c5e8762e0605addbeaec5b025141bb

SHA256

c7b83c5b3ab7114127fac61933145960b3b4e580eeab2f88eb31880fa447b910

SHA512

057f31fd27af340e5fb7b9457673f66bd674aef71ce08c0720fcd428e0590606929dd585da1dbdef30f7d6f359d456890452247d5a295d0a6be09fa89fead3b4

Malware Config

Extracted

Family

nanocore
Version

1.2.2.0
C2

kamuchehddhgfgf.ddns.net:1187

37.0.10.22:1187
Attributes
activate_away_mode
true
backup_connection_host
37.0.10.22
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-07-17T00:05:39.048278936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1187
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9ff0e8a4-a323-4111-bc49-0daecb63120d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
kamuchehddhgfgf.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000
Targets
Target

Order.exe

MD5

a0a1e071e11e2e6e08fdab2b881a6c97

Filesize

502KB

Score
10/10
SHA1

7b4624241b200c510b32bfc19e358c0857f1e737

SHA256

5bf04dc0a6c58392ab02344da78d8cf471f522f94a845974f33dac13a1e51af2

SHA512

fb0398f80e8b28a8ce006bfc19f2c7f2afc72608915f2acef8647c71f40df0b3c47c0ca56bec28e41b66accc5b32b55fd613c859db69c84cad3fca5fe8301895

Tags

Signatures

  • NanoCore

    Description

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    Tags

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

  • Checks whether UAC is enabled

    Tags

    TTPs

    System Information Discovery

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Tasks