Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2022 13:45

General

  • Target

    tmp.exe

  • Size

    486KB

  • MD5

    9c44d904890df75e5f1b7c3c3ba0b7db

  • SHA1

    2aea8311e7e1178396d5308d3853b6dc0334f849

  • SHA256

    e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d

  • SHA512

    bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788

  • SSDEEP

    12288:XnJYudWsonlmuKAJmK83qCz2B3aTO1EKoDIAzOZ:XJB3AmkmxSBIOZ

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

95.70.139.81:54984

Attributes
activate_away_mode
false
backup_connection_host
95.70.139.81
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-01T08:20:47.457547136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2afd92d3-82ee-48f4-9de3-98029fbb1ca4
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
95.70.139.81
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2112

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.log
                      MD5

                      8ec831f3e3a3f77e4a7b9cd32b48384c

                      SHA1

                      d83f09fd87c5bd86e045873c231c14836e76a05c

                      SHA256

                      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                      SHA512

                      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                    • memory/2112-137-0x0000000000000000-mapping.dmp
                    • memory/2112-138-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/4460-132-0x0000000000120000-0x00000000001A0000-memory.dmp
                    • memory/4460-133-0x0000000005170000-0x0000000005714000-memory.dmp
                    • memory/4460-134-0x0000000004BC0000-0x0000000004C52000-memory.dmp
                    • memory/4460-135-0x0000000004B60000-0x0000000004B6A000-memory.dmp
                    • memory/4460-136-0x0000000004E70000-0x0000000004F0C000-memory.dmp