Overview

overview

10

Static

static

4170483_In...pt.exe

windows7_x64

10

4170483_In...pt.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd121e0887a832c5a947fd4a773e744491ea8460fd36561001dc8bb9c483d323

  • Size

    522KB

  • Sample

    220520-2vvv9sgag5

  • MD5

    967ae0126be76b7f937aa690abc599e2

  • SHA1

    38781c2f8547cc0c541085b37fe971aecded1a5c

  • SHA256

    dd121e0887a832c5a947fd4a773e744491ea8460fd36561001dc8bb9c483d323

  • SHA512

    39612d72277f3ccc1fd6c9b10f06ae2c591fcc1c17d7c556ca3cf33e64b5fbb52c0b2feb08b914aa943ac6f60ed93071408fb6a2ae1a5ce5e938ab0507b97042

Score
10/10
nanocorekeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

omojune.duckdns.org:8090

Mutex

dcf5c8b2-cf5c-4745-a999-a029dd2150f1

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    omojune.duckdns.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-03-25T16:41:24.051441936Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    8090

  • default_group

    omo june

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    dcf5c8b2-cf5c-4745-a999-a029dd2150f1

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    omojune.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      4170483_Invoice_Receipt.exe

    • Size

      460KB

    • MD5

      4511daa7c1337065902a316e4c7b4d3a

    • SHA1

      6cbaf5ef11b9e98bdad70ddb7770a755a8801696

    • SHA256

      d67bf3c010c15c889233397faaaf9a258957b78d4e7c14f13cc795c784d14d8c

    • SHA512

      cb0103616f17651ab778971fb420ac30d34571b70034695f8fa113a28577e944fa3d42d16e6cc56e4bbb70569ae7bd8c6bece610f19b3229ba6ce0312509c623

    Score
    10/10
    nanocorekeyloggerspywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks