Overview

overview

10

Static

static

5

1ca85aac72...a5.exe

windows7-x64

10

1ca85aac72...a5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    187s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2022 14:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5.exe

  • Size

    1.0MB

  • MD5

    44e15865e8faf1d7cf63be6698efa0b0

  • SHA1

    221894e4d3c882b5d04df5b3fdb3efead3bf4925

  • SHA256

    1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5

  • SHA512

    3beefa6fde825a57fabae832a41f55614254848a7d82e424fa42d683002c7a66feb488b2c8bf5d1803bef8a705bcaba18234a818b7e3e3e65dd4706bb74c0414

  • SSDEEP

    12288:Stb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaK6NSYFIDOB7lOSMO6A:Stb20pkaCqT5TBWgNQ7aKP+7lWO6A

Score
10/10
nanocorekeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Attributes
  • activate_away_mode

    false

  • backup_connection_host

  • backup_dns_server

  • buffer_size

    0

  • build_time

    0001-01-01T00:00:00Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    0

  • connection_port

    0

  • default_group

  • enable_debug_mode

    false

  • gc_threshold

    0

  • keep_alive_timeout

    0

  • keyboard_logging

    false

  • lan_timeout

    0

  • max_packet_size

    0

  • mutex

  • mutex_timeout

    0

  • prevent_system_sleep

    false

  • primary_connection_host

  • primary_dns_server

  • request_elevation

    false

  • restart_delay

    0

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    false

  • timeout_interval

    0

  • use_custom_dns_server

    false

  • version

  • wan_timeout

    0

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5.exe
    "C:\Users\Admin\AppData\Local\Temp\1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Users\Admin\AppData\Local\Temp\1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5.exe
      "C:\Users\Admin\AppData\Local\Temp\1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\611833" "C:\Users\Admin\AppData\Local\Temp\1ca85aac72a8f791f34e4c2f100ae6f41a067b8cb7b97d5a8f7f8090ceec53a5.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:3472

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scripting

    1
    T1064

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\611833
      Filesize

      18KB

      MD5

      734247e41b3f3770ad86bc5c63c830bb

      SHA1

      c152ed8a5c6f8571157e290996d033810915d864

      SHA256

      e8ff2446a7e309970502b1906097c2c3beaf929bc079e9e48ab51161339250b1

      SHA512

      441db01448888aa2a325cdef7260fef59871be7353c76a02fb59a47e6f0079be4a220c740406ba4e6dd41b3615e760c009d9f3bf2868e90a908e3093d119757e

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\incl1
      Filesize

      13KB

      MD5

      f68121f66e91a2daa1d92537185633a1

      SHA1

      46e67a45a7e95075870edc779ed10c9adee01b68

      SHA256

      0d8e09973bec0dd7e8b2d73a0cd05c9eab6348441671b3a47b4c73dd4e5434f2

      SHA512

      43e3b333fca032dcc8720fece14b46001db0d26e3be5aa9ceab3b52dd072e344664abfdbc6e338d9b3e57f886a394ef9d1d9611cc58ecae1d2d86c8874fa0a05

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\incl2
      Filesize

      116KB

      MD5

      9b9b4fb01f7cdf9337cd984b58becb7b

      SHA1

      9f19773112a3a8442e966011c7274a84fa4c064e

      SHA256

      71f639d86b847d412ee5516fe0d9604e1abfe50142d155349c7bb934ba11e3ea

      SHA512

      d84012c13d35ed14a158ad0a51109ce4580573174d77f8336c9aeee659e021f08bd47712d0ef2a4a1b3e992fdeb079bc91fc3a1a165c8218d625a0505f3a94f1

      Download Submit
    • memory/1648-132-0x0000000000000000-mapping.dmp
      Download
    • memory/3472-136-0x0000000000000000-mapping.dmp
      Download
    • memory/3472-137-0x0000000000DD0000-0x0000000000DF4000-memory.dmp
      Filesize

      144KB

      Download
    • memory/3472-138-0x0000000005C30000-0x00000000061D4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/3472-139-0x00000000055B0000-0x0000000005642000-memory.dmp
      Filesize

      584KB

      Download
    • memory/3472-140-0x0000000005720000-0x00000000057BC000-memory.dmp
      Filesize

      624KB

      Download
    • memory/3472-141-0x0000000005590000-0x000000000559A000-memory.dmp
      Filesize

      40KB

      Download