Analysis
-
max time kernel
97s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 06:23
Static task
static1
Behavioral task
behavioral1
Sample
CV.exe
Resource
win7-20220414-en
General
-
Target
CV.exe
-
Size
559KB
-
MD5
3bbf14c6d3a535492bae4c32d890f931
-
SHA1
e345246d1f217357f4e351ff68b7967252149795
-
SHA256
10719517c091034e447d93a999e4797a32bdea3c651601ded9560fca01087cab
-
SHA512
90750190857b8632894db2a9b1ec8c144f0397d048a3b0472f1835093831051fcf06e17c5d57e58fcd051d7546c76bed41484ffde9875b5bed7b44a94a32a98a
Malware Config
Extracted
nanocore
1.2.2.0
derananocore.ddns.net:1187
194.87.84.118:1187
aee28d0a-78bc-4586-8c8c-8f93e292a11b
-
activate_away_mode
true
-
backup_connection_host
194.87.84.118
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-04-09T10:37:01.806212736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1187
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
aee28d0a-78bc-4586-8c8c-8f93e292a11b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
derananocore.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
CV.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Subsystem = "C:\\Program Files (x86)\\WPA Subsystem\\wpass.exe" CV.exe -
Processes:
CV.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CV.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CV.exedescription pid process target process PID 1528 set thread context of 2012 1528 CV.exe CV.exe -
Drops file in Program Files directory 2 IoCs
Processes:
CV.exedescription ioc process File created C:\Program Files (x86)\WPA Subsystem\wpass.exe CV.exe File opened for modification C:\Program Files (x86)\WPA Subsystem\wpass.exe CV.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
CV.exepid process 2012 CV.exe 2012 CV.exe 2012 CV.exe 2012 CV.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
CV.exepid process 2012 CV.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CV.exedescription pid process Token: SeDebugPrivilege 2012 CV.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
CV.exedescription pid process target process PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe PID 1528 wrote to memory of 2012 1528 CV.exe CV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CV.exe"C:\Users\Admin\AppData\Local\Temp\CV.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CV.exe"C:\Users\Admin\AppData\Local\Temp\CV.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1528-54-0x0000000001040000-0x00000000010D2000-memory.dmpFilesize
584KB
-
memory/1528-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1528-56-0x0000000000520000-0x0000000000536000-memory.dmpFilesize
88KB
-
memory/1528-57-0x0000000000540000-0x0000000000556000-memory.dmpFilesize
88KB
-
memory/1528-58-0x00000000007C0000-0x00000000007CA000-memory.dmpFilesize
40KB
-
memory/1528-59-0x0000000005050000-0x00000000050CE000-memory.dmpFilesize
504KB
-
memory/1528-60-0x0000000000D10000-0x0000000000D4A000-memory.dmpFilesize
232KB
-
memory/2012-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-68-0x000000000041E792-mapping.dmp
-
memory/2012-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2012-74-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/2012-75-0x0000000000360000-0x000000000037E000-memory.dmpFilesize
120KB
-
memory/2012-76-0x0000000000380000-0x000000000038A000-memory.dmpFilesize
40KB
-
memory/2012-77-0x00000000003F0000-0x0000000000402000-memory.dmpFilesize
72KB
-
memory/2012-78-0x00000000005A0000-0x00000000005BA000-memory.dmpFilesize
104KB
-
memory/2012-79-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/2012-81-0x00000000005E0000-0x00000000005EE000-memory.dmpFilesize
56KB
-
memory/2012-80-0x00000000005D0000-0x00000000005E2000-memory.dmpFilesize
72KB
-
memory/2012-82-0x0000000000600000-0x000000000060C000-memory.dmpFilesize
48KB
-
memory/2012-83-0x0000000000820000-0x0000000000834000-memory.dmpFilesize
80KB
-
memory/2012-84-0x0000000000830000-0x0000000000840000-memory.dmpFilesize
64KB
-
memory/2012-85-0x0000000000840000-0x0000000000854000-memory.dmpFilesize
80KB
-
memory/2012-86-0x0000000000850000-0x000000000085E000-memory.dmpFilesize
56KB
-
memory/2012-87-0x0000000000BE0000-0x0000000000C0E000-memory.dmpFilesize
184KB
-
memory/2012-88-0x0000000000D30000-0x0000000000D44000-memory.dmpFilesize
80KB