Malware sandboxing report by Hatching Triage

General

Target

Jens Frodesen CV.exe
Size

805KB
Sample

220927-hj7k5scgd7
MD5

210276dd5f377abe9e0b83e263507b83
SHA1

90f06579adc205e74b57f9abb48b6b3f2c25635d
SHA256

4d045c304e5cabb29318a9b07e9a6f41ff2172e72b704533a6f3b0bd79fba1c6
SHA512

f292bd6768caba952aee7e3f47e0f613f4bb15b2693a61e16384d6d3a78bbf03808f3285915d77e7bead1c39cbdba664786d7cdff2553dd86258d16763e2a6dd
SSDEEP

12288:gxDjQJlqtwEj1aIo1SUpomNVSs95FHP3jADqjJ5nt0+9MK:yj0qCEjpYjN75FDjrBe

Score

10^/10

Malware Config

Extracted

Family	nanocore
Version	1.2.2.0
C2	brightnano1.ddns.net:1989 171.22.30.97:1989 brightnano1.ddns.net:1989 171.22.30.97:1989
Attributes	activate_away_mode true backup_connection_host 171.22.30.97 backup_dns_server 8.8.4.4 buffer_size 65535 build_time 2022-06-10T14:34:05.030247036Z bypass_user_account_control false bypass_user_account_control_data PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+ clear_access_control true clear_zone_identifier false connect_delay 4000 connection_port 1989 default_group Default enable_debug_mode true gc_threshold 1.048576e+07 keep_alive_timeout 30000 keyboard_logging false lan_timeout 2500 max_packet_size 1.048576e+07 mutex fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe mutex_timeout 5000 prevent_system_sleep false primary_connection_host brightnano1.ddns.net primary_dns_server 8.8.8.8 request_elevation true restart_delay 5000 run_delay 0 run_on_startup false set_critical_process true timeout_interval 5000 use_custom_dns_server false version 1.2.2.0 wan_timeout 8000

Targets

- Target
  
  Jens Frodesen CV.exe
- Size
  
  805KB
- MD5
  
  210276dd5f377abe9e0b83e263507b83
- SHA1
  
  90f06579adc205e74b57f9abb48b6b3f2c25635d
- SHA256
  
  4d045c304e5cabb29318a9b07e9a6f41ff2172e72b704533a6f3b0bd79fba1c6
- SHA512
  
  f292bd6768caba952aee7e3f47e0f613f4bb15b2693a61e16384d6d3a78bbf03808f3285915d77e7bead1c39cbdba664786d7cdff2553dd86258d16763e2a6dd
- SSDEEP
  
  12288:gxDjQJlqtwEj1aIo1SUpomNVSs95FHP3jADqjJ5nt0+9MK:yj0qCEjpYjN75FDjrBe
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

Sharing

General

Malware Config

Extracted

Targets

NanoCore

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2