General

  • Target

    1820-63-0x0000000000400000-0x0000000000438000-memory.dmp

  • Size

    224KB

  • Sample

    220920-fw1l9affal

  • MD5

    9f69989bbce042d52a46ac763e272986

  • SHA1

    48a0451cf4533167db8a5af2dd4d9489301a5ed0

  • SHA256

    193b30ca5f237c69bce1188e5e285a34d5b5e5ab5c9b5d7cace7bd9cc7b5f625

  • SHA512

    2f8062cb1e6950178d37024a8d92bc873e61d976a3fca2389c81399bf421dc6b64df1c15d3a2e11e2bffcd7b48b0a32edd947200a7702b2533ddaed6d014fd8b

Score
10/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

95.70.139.81:54984

Attributes
activate_away_mode
false
backup_connection_host
95.70.139.81
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-01T08:20:47.457547136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2afd92d3-82ee-48f4-9de3-98029fbb1ca4
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
95.70.139.81
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

    • Target

      1820-63-0x0000000000400000-0x0000000000438000-memory.dmp

    • Size

      224KB

    • MD5

      9f69989bbce042d52a46ac763e272986

    • SHA1

      48a0451cf4533167db8a5af2dd4d9489301a5ed0

    • SHA256

      193b30ca5f237c69bce1188e5e285a34d5b5e5ab5c9b5d7cace7bd9cc7b5f625

    • SHA512

      2f8062cb1e6950178d37024a8d92bc873e61d976a3fca2389c81399bf421dc6b64df1c15d3a2e11e2bffcd7b48b0a32edd947200a7702b2533ddaed6d014fd8b

    Score
    1/10

MITRE ATT&CK Matrix