General
-
Target
efc8ef36ea0aff8174c55bb906e43ae10744ed0768ef6f636a406ec2412095a5
-
Size
616KB
-
Sample
221119-lkwrtaab7t
-
MD5
2720b4883eaea0307b997f7d7d15bbf0
-
SHA1
5f3bf431379a7e82e83ef51d745bea04b65e7183
-
SHA256
efc8ef36ea0aff8174c55bb906e43ae10744ed0768ef6f636a406ec2412095a5
-
SHA512
dbd78fbb65b386d5261f487899d84b1e7595267d4df2ced39208809272be4f1c9b457e28004ad1b0d06be855ee03eb4b354b9c67105202fcc95b2c4e938774eb
-
SSDEEP
12288:biaodU3dXTm1v5UFWfs72R6TQBMlvHfM6tYGOZvjee:b/tDMv5UFWfsvTEMJHfjYGOZree
Static task
static1
Behavioral task
behavioral1
Sample
efc8ef36ea0aff8174c55bb906e43ae10744ed0768ef6f636a406ec2412095a5.exe
Resource
win7-20220812-en
Malware Config
Extracted
nanocore
1.2.1.1
wharfedale.no-ip.org:81
80034d29-3292-4fa8-a152-02aa8b0ad86e
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2014-09-06T13:24:49.953869936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
81
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
80034d29-3292-4fa8-a152-02aa8b0ad86e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
wharfedale.no-ip.org
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.1.1
-
wan_timeout
8000
Targets
-
-
Target
efc8ef36ea0aff8174c55bb906e43ae10744ed0768ef6f636a406ec2412095a5
-
Size
616KB
-
MD5
2720b4883eaea0307b997f7d7d15bbf0
-
SHA1
5f3bf431379a7e82e83ef51d745bea04b65e7183
-
SHA256
efc8ef36ea0aff8174c55bb906e43ae10744ed0768ef6f636a406ec2412095a5
-
SHA512
dbd78fbb65b386d5261f487899d84b1e7595267d4df2ced39208809272be4f1c9b457e28004ad1b0d06be855ee03eb4b354b9c67105202fcc95b2c4e938774eb
-
SSDEEP
12288:biaodU3dXTm1v5UFWfs72R6TQBMlvHfM6tYGOZvjee:b/tDMv5UFWfsvTEMJHfjYGOZree
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-