Overview

overview

10

Static

static

Invoice#57786.exe

windows7-x64

10

Invoice#57786.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2022, 17:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Invoice#57786.exe
  • Size 1.1MB
  • Sample221102-vs4xtsdacl
  • SHA256 6ed9a8b54bcf003ce7c30232c4aec5b6e14dd4722238dd153e8d01a1494eca8f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
nanocoreevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • haserhym3.ddns.net:5422

  • 91.193.75.132:5422

Mutex

  • db62c3ca-a1b3-4110-9eba-8a7a8669b20e

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    91.193.75.132

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2022-08-11T05:23:41.456181736Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    5422

  • default_group

    Billionaire

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    db62c3ca-a1b3-4110-9eba-8a7a8669b20e

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    haserhym3.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice#57786.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice#57786.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\4_109\dpxjvjw.vbe"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Users\Admin\AppData\Local\Temp\4_109\fnne.exe
        "C:\Users\Admin\AppData\Local\Temp\4_109\fnne.exe" mvhijfpmuk.gcu
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1444

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ddsonj.xl
        • Path C:\Users\Admin\AppData\Local\Temp\4_109\ddsonj.xl
        • Size 63KB
        • SHA256 4fd215bc51f1be22582667577cc332237f98c372933b9a552a4e7f39f7d002ba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fnne.exe
        • Path C:\Users\Admin\AppData\Local\Temp\4_109\fnne.exe
        • Size 926KB
        • SHA256 9ba281fe8558eed56d9d03c8eac37e2ffaccc4659bb1c1df5152f4034409e14d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fnne.exe
        • Path C:\Users\Admin\AppData\Local\Temp\4_109\fnne.exe
        • Size 926KB
        • SHA256 9ba281fe8558eed56d9d03c8eac37e2ffaccc4659bb1c1df5152f4034409e14d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        knhsgx.tvj
        • Path C:\Users\Admin\AppData\Local\Temp\4_109\knhsgx.tvj
        • Size 405KB
        • SHA256 7d794148df58a15a631f5f2f953cb2ae73b2fb1e0588dbfe49eb74d2f1664117
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mvhijfpmuk.gcu
        • Path C:\Users\Admin\AppData\Local\Temp\4_109\mvhijfpmuk.gcu
        • Size 78.0MB
        • SHA256 d9f01431a09004f28f2d8fab6c24e375123eb2743008da6c3fe1f6135b97c59f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RegSvcs.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        • Size 44KB
        • SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RegSvcs.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        • Size 44KB
        • SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dpxjvjw.vbe
        • Path C:\Users\Admin\AppData\Local\temp\4_109\dpxjvjw.vbe
        • Size 27KB
        • SHA256 ef805d7703c17ef3cae5609de522a9ccba85043974e7526d5db33b53af9f0e35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1444-141-0x0000000000700000-0x0000000000BA7000-memory.dmp
        Download

        memory/1444-144-0x0000000000700000-0x0000000000738000-memory.dmp
        Download

        memory/1444-145-0x0000000005860000-0x0000000005E04000-memory.dmp
        Download

        memory/1444-146-0x0000000005160000-0x00000000051F2000-memory.dmp
        Download

        memory/1444-147-0x00000000052B0000-0x000000000534C000-memory.dmp
        Download

        memory/1444-148-0x0000000005210000-0x000000000521A000-memory.dmp
        Download

        memory/1444-149-0x0000000006A80000-0x0000000006AE6000-memory.dmp
        Download