Analysis

  • max time kernel
    207s
  • max time network
    217s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2022, 23:34

General

  • Target

    a91a05b74b2d81e3c08103ae753a2d5c85b49388af5e65016254a650971d4627.exe

  • Size

    1.3MB

  • MD5

    27cc743b428c3a5409c465aa21e0edb8

  • SHA1

    bcd2ea710d17c15c61ce0b5c03c9bf17404fb6c8

  • SHA256

    a91a05b74b2d81e3c08103ae753a2d5c85b49388af5e65016254a650971d4627

  • SHA512

    49cd55f3a0053f03129aa0a946730274d447ed4b1d8f33019e9657990571f050f3e5e8d39a4661e63934e8dff8ba803f56fcb97fc78a6dc44082ba597b46438a

  • SSDEEP

    24576:z2O/Gl39TYSk7apyJEGuKzQVWCLpoWI7g6zwzMgh/2Vse:gH7gJKVWIoWI5kIxOe

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

bravebizzle.no-ip.biz:1177

23.105.131.183:1177

Mutex

3db538fe-5a97-4435-ad66-0511ec2d3127

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    23.105.131.183

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2015-03-05T17:08:27.905109536Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    1177

  • default_group

    GOODLUCK

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    3db538fe-5a97-4435-ad66-0511ec2d3127

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    bravebizzle.no-ip.biz

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a91a05b74b2d81e3c08103ae753a2d5c85b49388af5e65016254a650971d4627.exe
    "C:\Users\Admin\AppData\Local\Temp\a91a05b74b2d81e3c08103ae753a2d5c85b49388af5e65016254a650971d4627.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe
      "C:\Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe" scmwrrzoij
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:340

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\67TXE3~1\WBPGOQ~1.UFR

          Filesize

          475KB

          MD5

          6a5abf9b5dc57110ea8ef9bd64ab4851

          SHA1

          a50e297ebea757da559938cfa0f677acb1bd2c20

          SHA256

          0c689d6e066060550a35297e6f18cb5c01b0d3bad976bd0be5fbc271234fe4f5

          SHA512

          9c4286019f56203e4a37530ba4a2defd77789132250739230f4cf46286f7ec7d269e3ef98ea89714bf5b417ae0e217324f3720ac3c7ecaedb0ef2f0e171cea92

        • C:\Users\Admin\67TXE3~1\eucf.TCK

          Filesize

          63B

          MD5

          00fcb14d3ec891ef487d8f4618b7b45c

          SHA1

          9f4f046a8aa1fdd374e252f9eadd51a4ce682ce4

          SHA256

          f9102f75119180dd0f1b28d5336849fdce20df1265ce68bead27191d9f794fce

          SHA512

          364c63b1b974f3aecbbd073fa01ed6032f734713cd14ec11ac86f6eebe401ecefce13b18e96f0e98ab200b17186706dad04c5a6dccefd8df736c3b8f3650b90f

        • C:\Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe

          Filesize

          732KB

          MD5

          71d8f6d5dc35517275bc38ebcc815f9f

          SHA1

          cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

          SHA256

          fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

          SHA512

          4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

        • C:\Users\Admin\67txe32ttuv2bg\scmwrrzoij

          Filesize

          674.7MB

          MD5

          3eb4279899ba49dbc6244b644bb0a156

          SHA1

          42062100d29ebb74a5c50d3dc2150789db06cc58

          SHA256

          80003ff0e0ef09ba55b497f3e157e887a4c998e323cbcd83d276573f2beccfcf

          SHA512

          3c705600d7f9bf7c0f9baccc587793d051f601c7d8588a0ea33c185eaa8d93f04e52b7b33b5b44fdb27633c0af33ed802c5fc66e9d56c17032d424eb74407974

        • \Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe

          Filesize

          732KB

          MD5

          71d8f6d5dc35517275bc38ebcc815f9f

          SHA1

          cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

          SHA256

          fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

          SHA512

          4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

        • \Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe

          Filesize

          732KB

          MD5

          71d8f6d5dc35517275bc38ebcc815f9f

          SHA1

          cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

          SHA256

          fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

          SHA512

          4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

        • \Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe

          Filesize

          732KB

          MD5

          71d8f6d5dc35517275bc38ebcc815f9f

          SHA1

          cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

          SHA256

          fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

          SHA512

          4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

        • \Users\Admin\67txe32ttuv2bg\oxglqmghppn.exe

          Filesize

          732KB

          MD5

          71d8f6d5dc35517275bc38ebcc815f9f

          SHA1

          cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

          SHA256

          fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

          SHA512

          4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

        • memory/340-67-0x0000000000270000-0x00000000002EC000-memory.dmp

          Filesize

          496KB

        • memory/340-76-0x0000000000690000-0x00000000006AA000-memory.dmp

          Filesize

          104KB

        • memory/340-65-0x0000000000270000-0x00000000002EC000-memory.dmp

          Filesize

          496KB

        • memory/340-84-0x0000000004DA5000-0x0000000004DB6000-memory.dmp

          Filesize

          68KB

        • memory/340-70-0x0000000000270000-0x00000000002EC000-memory.dmp

          Filesize

          496KB

        • memory/340-72-0x0000000000270000-0x00000000002EC000-memory.dmp

          Filesize

          496KB

        • memory/340-74-0x0000000000670000-0x000000000067A000-memory.dmp

          Filesize

          40KB

        • memory/340-75-0x0000000000680000-0x0000000000692000-memory.dmp

          Filesize

          72KB

        • memory/340-83-0x0000000004DA5000-0x0000000004DB6000-memory.dmp

          Filesize

          68KB

        • memory/340-77-0x0000000000780000-0x0000000000794000-memory.dmp

          Filesize

          80KB

        • memory/340-78-0x0000000000790000-0x00000000007AE000-memory.dmp

          Filesize

          120KB

        • memory/340-79-0x0000000000810000-0x000000000081A000-memory.dmp

          Filesize

          40KB

        • memory/340-80-0x0000000000860000-0x000000000086E000-memory.dmp

          Filesize

          56KB

        • memory/340-81-0x0000000000910000-0x000000000093E000-memory.dmp

          Filesize

          184KB

        • memory/340-82-0x00000000008C0000-0x00000000008D4000-memory.dmp

          Filesize

          80KB

        • memory/1224-54-0x0000000075291000-0x0000000075293000-memory.dmp

          Filesize

          8KB