General
-
Target
d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4
-
Size
326KB
-
Sample
220520-3ryneshde8
-
MD5
3f67a73e21c100365585e23ce369755c
-
SHA1
5fb76aeab3a212fa561f5b03095da87a4750e69b
-
SHA256
d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4
-
SHA512
f13aa9b436931097fa302e13fe1f168ae77a38321e6ac41687c3ef0b46cec7c90066f22ce5d7864ce68e9ff1c8e02b436305baf3a78c1599180b895cb91e4e6d
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20220414-en
Malware Config
Extracted
nanocore
1.2.2.0
apaduckdns.duckdns.org:54984
c854b3d3-3dd5-404d-a1d0-365efd3c6134
-
activate_away_mode
true
-
backup_connection_host
apaduckdns.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-14T03:04:44.373669836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
ZipoHouse
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c854b3d3-3dd5-404d-a1d0-365efd3c6134
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
apaduckdns.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
PURCHASE ORDER.exe
-
Size
506KB
-
MD5
37ca2dcb84070656527a45c9b3ff8589
-
SHA1
142947a1c23026c9dd723979bf8fd16d4f0e5f8b
-
SHA256
f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26
-
SHA512
cf5e369bc7944bd56007816f1eadb0c2452f63d3212fb73ba806c54dd24cda259cdd1415036642fd8fd8c248e13054d9e07fbb5bdfd51f712a7e72a7294e14ab
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-