Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2022 17:42

General

  • Target

    MDB.exe

  • Size

    860KB

  • MD5

    d84b1332e0fecd92b90b321f1f4a784a

  • SHA1

    5b6c2a0251ad7a5bbbf51d0ff300f8c29969693a

  • SHA256

    4f0a3115465d03a83773bec157884cbbf36858924e68115302f540d0ad02ee53

  • SHA512

    ce0e1e14ca9e6664e3022e40e5f9cafaad7b8deda933223855f619b189121411132864bec7e1a80818d65f62d053ca2f627a8d474c25385aa0f400fc31298444

  • SSDEEP

    12288:g91R6PxJfTADqjJ5n0U9C1DtGbQkc36b4Bao8pPTtcQMmWmeZA2:gefrjr0U85AbC3RGfcQnd

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

dera5nano.ddns.net:1010

107.182.129.248:1010

Attributes
activate_away_mode
true
backup_connection_host
107.182.129.248
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-06T12:07:01.612898436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1010
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
5a26bcef-e67f-486a-8e48-1748cc7891a2
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
dera5nano.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MDB.exe
    "C:\Users\Admin\AppData\Local\Temp\MDB.exe"
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SATancQW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp"
      Creates scheduled task(s)
      PID:2092
    • C:\Users\Admin\AppData\Local\Temp\MDB.exe
      "{path}"
      PID:2896
    • C:\Users\Admin\AppData\Local\Temp\MDB.exe
      "{path}"
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3140
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD779.tmp"
        Creates scheduled task(s)
        PID:3340
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD7D8.tmp"
        Creates scheduled task(s)
        PID:4344

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MDB.exe.log
                      MD5

                      84e77a587d94307c0ac1357eb4d3d46f

                      SHA1

                      83cc900f9401f43d181207d64c5adba7a85edc1e

                      SHA256

                      e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

                      SHA512

                      aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

                    • C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp
                      MD5

                      5bee1f9e26f50d6ebd04e66fea66fba3

                      SHA1

                      d6deac724ce99703d084a61ba2f55d9ca6460f88

                      SHA256

                      eae6658eb752a18301a57862a944fb6decde63688339dcbccbcd5a78edc2f5fe

                      SHA512

                      d1e7edd84cd4bbef2fa022cca4f09b0dac2a10e3adf20eb6301f64e25b1968b31f15e376f9d74a1273bca6d00bb18856c041d34e7633863df7a8b9d5dedb1e5e

                    • C:\Users\Admin\AppData\Local\Temp\tmpD779.tmp
                      MD5

                      671c79cd978749f6b39fc08dbff8a77d

                      SHA1

                      e05b2370ae4ba264f2f7e2cdf75450435b211e20

                      SHA256

                      2011c9c1d2a4445b7a9fc98d3dfce9f0dd48ce3b8ec1242b96e6fbf7ac65fb5b

                      SHA512

                      70dfca3506412b2f26e05dae58b86c86d67ee46551313a2066450fef489943e884ae28334f92f79d06a840b3ca240d9f09439347f44ca9ccd8aad7f572cbc53d

                    • C:\Users\Admin\AppData\Local\Temp\tmpD7D8.tmp
                      MD5

                      2271642ca970891700e3f48439739ed8

                      SHA1

                      cd472df2349f7db9e1e460d0ee28acd97b8a8793

                      SHA256

                      7aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68

                      SHA512

                      4669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807

                    • memory/1800-136-0x0000000005720000-0x000000000572A000-memory.dmp
                    • memory/1800-132-0x0000000000CA0000-0x0000000000D7E000-memory.dmp
                    • memory/1800-135-0x0000000005800000-0x000000000589C000-memory.dmp
                    • memory/1800-134-0x0000000005760000-0x00000000057F2000-memory.dmp
                    • memory/1800-133-0x0000000005C70000-0x0000000006214000-memory.dmp
                    • memory/2092-137-0x0000000000000000-mapping.dmp
                    • memory/2896-139-0x0000000000000000-mapping.dmp
                    • memory/3140-140-0x0000000000000000-mapping.dmp
                    • memory/3140-141-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/3140-147-0x0000000006A60000-0x0000000006AC6000-memory.dmp
                    • memory/3340-143-0x0000000000000000-mapping.dmp
                    • memory/4344-145-0x0000000000000000-mapping.dmp