Overview

overview

10

Static

static

Quotation_...62.exe

windows7_x64

10

Quotation_...62.exe

windows10-2004_x64

6

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 12:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Quotation_AxFlow_z.07622562.exe

  • Size

    330KB

  • MD5

    d2282165d0347879d28f1e5c928bc606

  • SHA1

    f2aebf69802415775b65c1f5e6bb18f202e125f7

  • SHA256

    5dd4b4e5c60eef42542078f752201788a7a0889b7e494551ef20a8f537295e63

  • SHA512

    f6cb71cca6ebed02528e2dfba77aaa366d9951e157271658e74447448cb933b7518c110a825f30d5f2dbcb782e2c568e1e9d7c8103a5fad01c25e237903ce55f

Score
10/10
nanocoreevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

79.134.225.95:8585

Mutex

c0952507-462f-4ce6-ae9c-ce8bb06f4a77

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-02-29T05:21:55.732548136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    8585

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    c0952507-462f-4ce6-ae9c-ce8bb06f4a77

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    79.134.225.95

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe"
      2⤵
        PID:804
      • C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe"
        2⤵
          PID:968
        • C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe"
          2⤵
            PID:976
          • C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation_AxFlow_z.07622562.exe"
            2⤵
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1692

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1692-68-0x000000000041E792-mapping.dmp
          Download
        • memory/1692-67-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1692-64-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1692-65-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1692-62-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1692-75-0x0000000001D70000-0x0000000001D8E000-memory.dmp
          Filesize

          120KB

          Download
        • memory/1692-74-0x0000000001D60000-0x0000000001D6A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/1692-61-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1692-76-0x0000000001DD0000-0x0000000001DDA000-memory.dmp
          Filesize

          40KB

          Download
        • memory/1692-72-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1692-70-0x0000000000400000-0x0000000000438000-memory.dmp
          Filesize

          224KB

          Download
        • memory/1884-59-0x0000000000740000-0x0000000000756000-memory.dmp
          Filesize

          88KB

          Download
        • memory/1884-54-0x00000000002D0000-0x0000000000328000-memory.dmp
          Filesize

          352KB

          Download
        • memory/1884-57-0x0000000000530000-0x0000000000546000-memory.dmp
          Filesize

          88KB

          Download
        • memory/1884-56-0x00000000004E0000-0x0000000000528000-memory.dmp
          Filesize

          288KB

          Download
        • memory/1884-60-0x0000000000800000-0x0000000000812000-memory.dmp
          Filesize

          72KB

          Download
        • memory/1884-55-0x00000000002C0000-0x00000000002C8000-memory.dmp
          Filesize

          32KB

          Download
        • memory/1884-58-0x00000000759E1000-0x00000000759E3000-memory.dmp
          Filesize

          8KB

          Download