Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-09-2022 05:45

General

  • Target

    3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe

  • Size

    180KB

  • MD5

    d68c1898ceffa72ba1ac579c83cc494c

  • SHA1

    0cbea644e19ae6d3b934a648b5bd1a9558c64e96

  • SHA256

    3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc

  • SHA512

    35b09232dd1abb7d23910e64d09e6bebd43bc2469c6e4d44a2a4ed8fd88051ec0d08206a8fce25f1efb5aa85cefb9a8d87ddf9adb026029894c5481a19bb1b43

  • SSDEEP

    1536:0GBVDgKMoum8X/ScqsClbZ5hapDbEJ0XIPnG+aaMrIl0PegZoZZZZZZZZZZZZZgJ:0muRjClb81C5adRQQelxyAx9fCTt

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

95.70.139.81:54984

Attributes
activate_away_mode
false
backup_connection_host
95.70.139.81
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-01T08:20:47.457547136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2afd92d3-82ee-48f4-9de3-98029fbb1ca4
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
95.70.139.81
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 2 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 4 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe
    "C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe
      "C:\Users\Admin\AppData\Local\Temp\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe"
      PID:4236
    • C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe
      C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe
        "C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe"
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        PID:708

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc.exe.log
                      MD5

                      1254c55dd47bb823e0ce10dff0298a20

                      SHA1

                      de1c780a4c75090053003f4eb606fe481f6126aa

                      SHA256

                      16f124d47c9cda13c9ead5a1061eda573201b16ca09b66ea2d30d41c3ab1f562

                      SHA512

                      96d562b16ed0436a2aa45d5ee83af82f0be34f2d1d48a21cefe57bc1b95a4d788c19a59cf7d8eacfe6e01f88c918675591c1e2e05782c659918562b77fc3eb6e

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IAppIdAuthority.exe.log
                      MD5

                      0c2899d7c6746f42d5bbe088c777f94c

                      SHA1

                      622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

                      SHA256

                      5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

                      SHA512

                      ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

                    • C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe
                      MD5

                      9c44d904890df75e5f1b7c3c3ba0b7db

                      SHA1

                      2aea8311e7e1178396d5308d3853b6dc0334f849

                      SHA256

                      e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d

                      SHA512

                      bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788

                    • C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe
                      MD5

                      9c44d904890df75e5f1b7c3c3ba0b7db

                      SHA1

                      2aea8311e7e1178396d5308d3853b6dc0334f849

                      SHA256

                      e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d

                      SHA512

                      bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788

                    • C:\Users\Admin\AppData\Local\Temp\IAppIdAuthority.exe
                      MD5

                      9c44d904890df75e5f1b7c3c3ba0b7db

                      SHA1

                      2aea8311e7e1178396d5308d3853b6dc0334f849

                      SHA256

                      e7763c3bb26ac869ce31f856dbd583c7b64979afcadbbcff4618c7d42c1feb6d

                      SHA512

                      bcf9af878879865941d85934df601fb00afc59d8bf2191b609c8d11ccf2205d100aea80c74118783e3e5f19b893a9c3dd2aff4db2792c3205645662661f69788

                    • memory/708-302-0x000000000041E792-mapping.dmp
                    • memory/708-369-0x00000000050D0000-0x00000000050DA000-memory.dmp
                    • memory/708-367-0x00000000050B0000-0x00000000050CE000-memory.dmp
                    • memory/708-366-0x0000000004BB0000-0x0000000004BBA000-memory.dmp
                    • memory/708-340-0x0000000000600000-0x0000000000638000-memory.dmp
                    • memory/2764-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-149-0x0000000000560000-0x0000000000594000-memory.dmp
                    • memory/2764-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-153-0x0000000004D90000-0x0000000004E2C000-memory.dmp
                    • memory/2764-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-185-0x0000000004D80000-0x0000000004D92000-memory.dmp
                    • memory/2764-191-0x0000000005B40000-0x000000000603E000-memory.dmp
                    • memory/2764-219-0x0000000005750000-0x00000000057E2000-memory.dmp
                    • memory/2764-228-0x0000000005720000-0x000000000572A000-memory.dmp
                    • memory/2764-116-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-117-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/2764-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp
                    • memory/4112-276-0x00000000000E0000-0x0000000000160000-memory.dmp
                    • memory/4112-239-0x0000000000000000-mapping.dmp
                    • memory/4112-299-0x00000000049C0000-0x00000000049D0000-memory.dmp
                    • memory/4236-187-0x0000000000402EEE-mapping.dmp
                    • memory/4236-222-0x0000000000400000-0x0000000000408000-memory.dmp