General
-
Target
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
-
Size
328KB
-
Sample
220912-jspblagfan
-
MD5
d4c5e5e909ff0def4cd6be23a09d43ae
-
SHA1
d7ce18914c638c66d6e5377c40adf22c7c847289
-
SHA256
64f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
-
SHA512
01bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
SSDEEP
6144:ty3ZvTcfs331nuT8n2+a0JDj21k4/WQUDu5IYuVpij4eNtkH9d7mCvd:t0vTcfsHcwn2+tkVODDOqgUKt+3mC
Static task
static1
Behavioral task
behavioral1
Sample
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
Resource
win7-20220812-en
Malware Config
Extracted
nanocore
1.2.2.0
intercambiotestg99.duckdns.org:1501
38adc800-c0b8-451a-9a6c-a172c6e3f300
-
activate_away_mode
true
-
backup_connection_host
intercambiotestg99.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-06-21T02:56:21.560821236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
1501
-
default_group
Team
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
38adc800-c0b8-451a-9a6c-a172c6e3f300
-
mutex_timeout
5000
-
prevent_system_sleep
true
- primary_connection_host
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
-
Size
328KB
-
MD5
d4c5e5e909ff0def4cd6be23a09d43ae
-
SHA1
d7ce18914c638c66d6e5377c40adf22c7c847289
-
SHA256
64f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
-
SHA512
01bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
SSDEEP
6144:ty3ZvTcfs331nuT8n2+a0JDj21k4/WQUDu5IYuVpij4eNtkH9d7mCvd:t0vTcfsHcwn2+tkVODDOqgUKt+3mC
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-