Malware sandboxing report by Hatching Triage

General

Target

01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f
Size

1MB
Sample

221002-1xr2qaeaeq
MD5

6d1968a29a85d8da0aba07325a112470
SHA1

8c33dd887ee77217bbe45cac603af501884eac06
SHA256

01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f
SHA512

71e3c16b1eaf63953732abf19f90826c730b22bcf283889843628cfe1218268c1ad714ef71005c32e03fc8921b9bcced5e670d330df62ef9c0868b05d48c4f96
SSDEEP

24576:xthEVaPqLB/OXA8faoMTRpyiLthEVaPqLB/OXA8faoMTRpyiZ:pEVUcwkB3VfEVUcwkB3VZ

Score

10^/10

Malware Config

Extracted

Family	nanocore
Version	1.2.2.0
C2	lolli.no-ip.info:1133 lolli.no-ip.info:1133
Attributes	activate_away_mode true backup_connection_host lolli.no-ip.info backup_dns_server 8.8.4.4 buffer_size 65535 build_time 2015-02-05T19:59:01.018438736Z bypass_user_account_control false bypass_user_account_control_data PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+ clear_access_control true clear_zone_identifier false connect_delay 4000 connection_port 1133 default_group extreme v2 tut enable_debug_mode true gc_threshold 1.048576e+07 keep_alive_timeout 30000 keyboard_logging false lan_timeout 2500 max_packet_size 1.048576e+07 mutex e230b6f6-7d07-46a4-ae63-b23db679b6b4 mutex_timeout 5000 prevent_system_sleep false primary_connection_host lolli.no-ip.info primary_dns_server 8.8.8.8 request_elevation true restart_delay 5000 run_delay 0 run_on_startup false set_critical_process true timeout_interval 5000 use_custom_dns_server false version 1.2.2.0 wan_timeout 8000

Targets

- Target
  
  01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f
- Size
  
  1MB
- MD5
  
  6d1968a29a85d8da0aba07325a112470
- SHA1
  
  8c33dd887ee77217bbe45cac603af501884eac06
- SHA256
  
  01ec0b4c297da51d2cda52fd4d2f164874bd797fd699357d999e8228aee8e41f
- SHA512
  
  71e3c16b1eaf63953732abf19f90826c730b22bcf283889843628cfe1218268c1ad714ef71005c32e03fc8921b9bcced5e670d330df62ef9c0868b05d48c4f96
- SSDEEP
  
  24576:xthEVaPqLB/OXA8faoMTRpyiLthEVaPqLB/OXA8faoMTRpyiZ:pEVUcwkB3VfEVUcwkB3VZ
Score

10^/10

upx nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

System Information Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

Sharing

General

Malware Config

Extracted

Targets

NanoCore

Executes dropped EXE

UPX packed file

Adds Run key to start application

Checks whether UAC is enabled

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2