Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
25-10-2022 06:27
General
-
Target
9804e6106f033720485576c68d4c1abe9a6c52ca020c2e59686bc533b8e2495a.exe
-
Size
525KB
-
MD5
c47d4e835ec66bd96f6139bf712ec155
-
SHA1
13710b381acbfe1a0b8fa013f0237507758ebc51
-
SHA256
9804e6106f033720485576c68d4c1abe9a6c52ca020c2e59686bc533b8e2495a
-
SHA512
ff8ff1e0d4302ff6828d8e75da8effce8e23faedba99fc9d3ad8fe98088355436baa83d6da3c7bd0d49806d886b4ac813f215c7d5682d01ae56c1a7ff5bf94f7
-
SSDEEP
12288:WVnh7wW+nNYu+0mVAxxGsw9msINpccz3dljo:A8NYu+DV/IMe0
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
f6041bb2-7c7b-4774-acc8-84a131b635ab
-
activate_away_mode
true
-
backup_connection_host
tzitziklishop.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-07-22T04:21:36.365135136Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
OCTOBER
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f6041bb2-7c7b-4774-acc8-84a131b635ab
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9804e6106f033720485576c68d4c1abe9a6c52ca020c2e59686bc533b8e2495a.exe"C:\Users\Admin\AppData\Local\Temp\9804e6106f033720485576c68d4c1abe9a6c52ca020c2e59686bc533b8e2495a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9804e6106f033720485576c68d4c1abe9a6c52ca020c2e59686bc533b8e2495a.exe"C:\Users\Admin\AppData\Local\Temp\9804e6106f033720485576c68d4c1abe9a6c52ca020c2e59686bc533b8e2495a.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6561.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp669A.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5e05e66e5351ebf9c220f355dfc8d9826
SHA18d6a088c650d140d2639ff7c7b386cb1b4a5a82c
SHA2561b45b02f410eed9b95e20176facfcd3155aeaec65a3091a3c9c885eb0b657fdf
SHA512c60d3f210582c845cf5e7d44fd0f50df1c2f30d5161fa9b25af2f106f302cb759858ed21e6b3e6c4b6aa3bea3595f1f4cb0b79a9f6fcb0125bbb5744d9383c7b
-
Filesize
1KB
MD55f302e51d2067ad3bc5f3737c9f5c136
SHA1253f33f2c3866573bb064e0e4b01ad9cf9e1d8dc
SHA256a0362c216f87f9a10bdff9fe1048db341b0736f53047704c276c04b034aaec85
SHA5120d6739050e9a4d401688887c3b7aab0f6135d5dd934e38fe6ba12d5a1f20c1d4a9cfce9ca7e4a51cad08968c535a2e74cdd9aad7bc9506b12ff580d27c6ba24f
-
Filesize
1KB
MD5f5c88edc70516bc96f4edf9ff3f5d7cd
SHA173d6689e32a97f3887fe88e0625fd3452ab480db
SHA25687352900601dc127efe3ee3e9952e94a72aa04b02ff9e9e3e01ffa5a44edca4b
SHA5122e69e1ad4b2c4236b55ace46b9dbc1e777cc109203f084cdb1263c74ae4035896d9b909e88f1f65b37a1551c6a3b0c0f9f2d22dbe7f6f49a8383ba56759ea1dd
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
544KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
96KB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
48KB
-
Filesize
464KB
-
Filesize
624KB
-
Filesize
232KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
408KB
-
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
5.0MB
-
Filesize
224KB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
184KB
-
Filesize
80KB
-