Description
NanoCore is a remote access tool (RAT) with a variety of capabilities.
Order.7z
General
Target
Size
Sample
Order.7z
427KB
211103-1q6ljacear
Score
10 /10
MD5
SHA1
SHA256
SHA512
734e991a781c52b6441526029efa8da1
84afee0845c5e8762e0605addbeaec5b025141bb
c7b83c5b3ab7114127fac61933145960b3b4e580eeab2f88eb31880fa447b910
057f31fd27af340e5fb7b9457673f66bd674aef71ce08c0720fcd428e0590606929dd585da1dbdef30f7d6f359d456890452247d5a295d0a6be09fa89fead3b4
Malware Config
Extracted
| Family | nanocore |
| Version | 1.2.2.0 |
| C2 |
kamuchehddhgfgf.ddns.net:1187 37.0.10.22:1187 |
| Attributes |
activate_away_mode true
backup_connection_host 37.0.10.22
backup_dns_server 8.8.4.4
buffer_size 65535
build_time 2021-07-17T00:05:39.048278936Z
bypass_user_account_control true
bypass_user_account_control_data
clear_access_control true
clear_zone_identifier false
connect_delay 4000
connection_port 1187
default_group Default
enable_debug_mode true
gc_threshold 1.048576e+07
keep_alive_timeout 30000
keyboard_logging false
lan_timeout 2500
max_packet_size 1.048576e+07
mutex 9ff0e8a4-a323-4111-bc49-0daecb63120d
mutex_timeout 5000
prevent_system_sleep false
primary_connection_host kamuchehddhgfgf.ddns.net
primary_dns_server 8.8.8.8
request_elevation true
restart_delay 5000
run_delay 0
run_on_startup false
set_critical_process true
timeout_interval 5000
use_custom_dns_server false
version 1.2.2.0
wan_timeout 8000 |
Targets
Target
MD5
Filesize
Order.exe
a0a1e071e11e2e6e08fdab2b881a6c97
502KB
Score
10/10
SHA1
SHA256
SHA512
7b4624241b200c510b32bfc19e358c0857f1e737
5bf04dc0a6c58392ab02344da78d8cf471f522f94a845974f33dac13a1e51af2
fb0398f80e8b28a8ce006bfc19f2c7f2afc72608915f2acef8647c71f40df0b3c47c0ca56bec28e41b66accc5b32b55fd613c859db69c84cad3fca5fe8301895
Tags
Signatures
-
NanoCore
-
Adds Run key to start application
Tags
TTPs
-
Checks whether UAC is enabled
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks