Analysis
- max time kernel
155s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
26/11/2022, 23:37
General
- Target a028f14dde5e1cf076c6d180edc994cf385a91a7b0e858156bec56bc00877256.exe
- Size 270KB
- Sample221126-3l949sdc63
- SHA256 a028f14dde5e1cf076c6d180edc994cf385a91a7b0e858156bec56bc00877256
Malware Config
Extracted
-
nanocore
-
activate_away_mode
false
- backup_connection_host
- backup_dns_server
-
buffer_size
0
-
build_time
0001-01-01T00:00:00Z
-
bypass_user_account_control
false
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
0
-
connection_port
0
- default_group
-
enable_debug_mode
false
-
gc_threshold
0
-
keep_alive_timeout
0
-
keyboard_logging
false
-
lan_timeout
0
-
max_packet_size
0
- mutex
-
mutex_timeout
0
-
prevent_system_sleep
false
- primary_connection_host
- primary_dns_server
-
request_elevation
false
-
restart_delay
0
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
0
-
use_custom_dns_server
false
- version
-
wan_timeout
0
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a028f14dde5e1cf076c6d180edc994cf385a91a7b0e858156bec56bc00877256.exe"C:\Users\Admin\AppData\Local\Temp\a028f14dde5e1cf076c6d180edc994cf385a91a7b0e858156bec56bc00877256.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6QZxCPSXxz.exe"C:\Users\Admin\AppData\Local\Temp\6QZxCPSXxz.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
6QZxCPSXxz.exe
6QZxCPSXxz.exe
memory/2016-141-0x00000000703A0000-0x0000000070951000-memory.dmp
memory/2016-142-0x00000000703A0000-0x0000000070951000-memory.dmp
memory/2736-132-0x0000000000450000-0x000000000047C000-memory.dmp
memory/2736-133-0x0000000004E20000-0x0000000004EBC000-memory.dmp
memory/2736-134-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/2736-135-0x0000000004FA0000-0x0000000005032000-memory.dmp
memory/2736-136-0x0000000004E10000-0x0000000004E1A000-memory.dmp
memory/2736-137-0x0000000005040000-0x0000000005096000-memory.dmp