Analysis

  • max time kernel
    88s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2022 07:55

General

  • Target

    69956e7cc66b2e6b4a15dc779d63b459.exe

  • Size

    977KB

  • MD5

    69956e7cc66b2e6b4a15dc779d63b459

  • SHA1

    63e96a654fd677da56b73d14fc588a3581e8d57e

  • SHA256

    38403140be153292b9fa08bcd87dae41e0f9e26327aaac95a05fea54decc291b

  • SHA512

    ffa9729470e7cfde290ce3a406637d0b1e35a9d3af912f826c879ff4021fb4ac2de0a2adb183b881836ca3e073ae196e8b50f9be91ff10091e0d2700b4b1dc77

  • SSDEEP

    12288:0QhLuyAHRzxXSG2tmkgHAkC7trKPGCoY3qyfnkgl9TnmVuLkQDsGE1qF:lhLuyy6LtC+7ZKoifnHTn01GEc

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

jasonbourne.bounceme.net:4032

127.0.0.1:4032

Attributes
activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-24T09:47:26.371156736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4032
default_group
X File
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9c6d4c8a-884b-4287-8ce0-7edf4a237b07
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
jasonbourne.bounceme.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69956e7cc66b2e6b4a15dc779d63b459.exe
    "C:\Users\Admin\AppData\Local\Temp\69956e7cc66b2e6b4a15dc779d63b459.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\69956e7cc66b2e6b4a15dc779d63b459.exe
      "C:\Users\Admin\AppData\Local\Temp\69956e7cc66b2e6b4a15dc779d63b459.exe"
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB2CC.tmp"
        Creates scheduled task(s)
        PID:1416
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB405.tmp"
        Creates scheduled task(s)
        PID:776

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\tmpB2CC.tmp
                      MD5

                      137bc997d3916e14960a92b7e8b0717d

                      SHA1

                      4edfc67cdcd4e0bcf0ebaf6485cbaff6ea75c3da

                      SHA256

                      703facd723f9b541c3385ffa763dd052f647d5a1225ec4a8a26fd6028c38e9ad

                      SHA512

                      80f2230d48c74a236c0d9c91ed6523de7971d985da6ff0c2b8d6888cb70c388d52aedd1dc3f8e9a8e26cf04f7be328e9c183ab232e94e909be2dd870d61a3673

                    • C:\Users\Admin\AppData\Local\Temp\tmpB405.tmp
                      MD5

                      4e71faa3a77029484cfaba423d96618f

                      SHA1

                      9c837d050bb43d69dc608af809c292e13bca4718

                      SHA256

                      c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb

                      SHA512

                      6d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0

                    • memory/776-76-0x0000000000000000-mapping.dmp
                    • memory/1416-74-0x0000000000000000-mapping.dmp
                    • memory/1824-55-0x0000000075571000-0x0000000075573000-memory.dmp
                    • memory/1824-56-0x00000000004C0000-0x00000000004D4000-memory.dmp
                    • memory/1824-57-0x0000000000550000-0x0000000000564000-memory.dmp
                    • memory/1824-58-0x0000000000680000-0x000000000068C000-memory.dmp
                    • memory/1824-59-0x0000000008160000-0x000000000820A000-memory.dmp
                    • memory/1824-60-0x0000000004D80000-0x0000000004DD0000-memory.dmp
                    • memory/1824-54-0x00000000001F0000-0x00000000002EA000-memory.dmp
                    • memory/1972-62-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-81-0x0000000000800000-0x0000000000812000-memory.dmp
                    • memory/1972-70-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-72-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-67-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-65-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-64-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-61-0x0000000000400000-0x0000000000438000-memory.dmp
                    • memory/1972-78-0x0000000000560000-0x000000000056A000-memory.dmp
                    • memory/1972-79-0x0000000000590000-0x00000000005AE000-memory.dmp
                    • memory/1972-80-0x0000000000570000-0x000000000057A000-memory.dmp
                    • memory/1972-68-0x000000000041E792-mapping.dmp
                    • memory/1972-82-0x0000000000A00000-0x0000000000A1A000-memory.dmp
                    • memory/1972-83-0x0000000002150000-0x000000000215E000-memory.dmp
                    • memory/1972-84-0x0000000002170000-0x0000000002182000-memory.dmp
                    • memory/1972-85-0x00000000021C0000-0x00000000021CE000-memory.dmp
                    • memory/1972-86-0x00000000021D0000-0x00000000021DC000-memory.dmp
                    • memory/1972-87-0x00000000021E0000-0x00000000021F4000-memory.dmp
                    • memory/1972-88-0x00000000021F0000-0x0000000002200000-memory.dmp
                    • memory/1972-89-0x0000000002200000-0x0000000002214000-memory.dmp
                    • memory/1972-90-0x0000000002210000-0x000000000221E000-memory.dmp
                    • memory/1972-91-0x0000000002270000-0x000000000229E000-memory.dmp
                    • memory/1972-92-0x00000000022A0000-0x00000000022B4000-memory.dmp