Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2022, 23:45

General

  • Target

    96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe

  • Size

    880KB

  • MD5

    168a2c2ce1f613b4d70619fa695e6b78

  • SHA1

    f10cb10f36c98dac6f41b5012acd976f281e7d90

  • SHA256

    96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322

  • SHA512

    bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

  • SSDEEP

    12288:sZhUf7LXHxRqPRR1cI/lMb5QWS/DWQt28QQwyp0dewzuJ/zg/EukKAFGnyTz4+Du:skLXHjqPV+Fqt28wvTaYERKAFSMiP

Malware Config

Extracted

Family

nanocore

Version

1.2.1.1

C2

mcsoft.noip.me:1122

r0c.ddns.net:1122

Mutex

0f01c8f8-e5b8-4d3f-85f7-c9b862c3088b

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    r0c.ddns.net

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2014-09-10T18:22:22.056357136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1122

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    0f01c8f8-e5b8-4d3f-85f7-c9b862c3088b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    mcsoft.noip.me

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.1.1

  • wan_timeout

    8000

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Drops startup file 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe
    "C:\Users\Admin\AppData\Local\Temp\96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\Pop4.exe
      "C:\Users\Admin\AppData\Local\Temp\Pop4.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      PID:1296
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Roaming\Windows\mata.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Roaming\Windows\invs.vbs" "C:\Users\Admin\AppData\Roaming\Windows\mata2.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Windows\mata2.bat" "
          4⤵
          • Drops startup file
          PID:1276
    • C:\Users\Admin\AppData\Roaming\notepad .exe
      "C:\Users\Admin\AppData\Roaming\notepad .exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\Windows\notepad.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 300
        3⤵
        • Delays execution with timeout.exe
        PID:1944

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Pop4.exe

          Filesize

          31KB

          MD5

          f897f903e4942678ec765a31eda224fb

          SHA1

          dbd82191f21b95abb8db284950059950d4bb780d

          SHA256

          8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091

          SHA512

          67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

        • C:\Users\Admin\AppData\Local\Temp\Pop4.exe

          Filesize

          31KB

          MD5

          f897f903e4942678ec765a31eda224fb

          SHA1

          dbd82191f21b95abb8db284950059950d4bb780d

          SHA256

          8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091

          SHA512

          67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

        • C:\Users\Admin\AppData\Roaming\Windows\amptask.exe

          Filesize

          880KB

          MD5

          168a2c2ce1f613b4d70619fa695e6b78

          SHA1

          f10cb10f36c98dac6f41b5012acd976f281e7d90

          SHA256

          96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322

          SHA512

          bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

        • C:\Users\Admin\AppData\Roaming\Windows\invs.vbs

          Filesize

          78B

          MD5

          c578d9653b22800c3eb6b6a51219bbb8

          SHA1

          a97aa251901bbe179a48dbc7a0c1872e163b1f2d

          SHA256

          20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

          SHA512

          3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

        • C:\Users\Admin\AppData\Roaming\Windows\mata.bat

          Filesize

          69B

          MD5

          90f43387dc853e2f6012421794bce803

          SHA1

          175c394ede22184a3de907018504ca78ad9f8fe9

          SHA256

          ea9a9a1f2b36eb85a12ac384ceea8eb50aae661164741abaff273d4064b7fadc

          SHA512

          c1e3a52ef4ec660512bd14ad4afca0597b22992379ffc512e6184bcdc8e8396bc7d684cb68e88769afc471635fb14ada8b7f83de763c238a0ff837290dcd5b0d

        • C:\Users\Admin\AppData\Roaming\Windows\mata2.bat

          Filesize

          182B

          MD5

          0b187db0d3d9e528e2a2b1a5cdf5ea00

          SHA1

          013a7a5a84318d53d2ff73228eb44c512384a007

          SHA256

          23d53516761e4b167166d781ad41ecd717a76016c8694f2af27dd4b60fc12b21

          SHA512

          4408effa053b30a56cbd4c27f56fb49c2124192297f216ab72fc6f0a2e8eeea8b00e8312710abac485f4f6adc6e138be224a35fc3d6f6444e2c5c13c5645f8e9

        • C:\Users\Admin\AppData\Roaming\Windows\notepad.bat

          Filesize

          208B

          MD5

          c2e905cdf49e21a46637203e212217e8

          SHA1

          a697d162bb1208e6a67214d05cea697ebbbf2732

          SHA256

          65fa669a0a06900043e32ebca9721abd3dbb60b21c96fbf78d37712b6cc6bc1e

          SHA512

          20eee69e49286f50eb84c244fc5fdcf8952e5750d467e631d85d516a17b15cfe6626860f78368c142381dad6e6678f60d069efbfc3f8dae01e1a7a9903870f41

        • C:\Users\Admin\AppData\Roaming\Windows\rundll11-.txt

          Filesize

          880KB

          MD5

          168a2c2ce1f613b4d70619fa695e6b78

          SHA1

          f10cb10f36c98dac6f41b5012acd976f281e7d90

          SHA256

          96b39ed0e1d194c901c52781a2cfc872751f072d77c88732ff34a5806f7d0322

          SHA512

          bf8fbc62652dceea06973402178dbd081eedc394cd591874670c60563bb1d8f1d0710101c2784b21aa2a37eb6b6214fe06624e98ad94ce165abdc1bc4888da98

        • C:\Users\Admin\AppData\Roaming\notepad .exe

          Filesize

          52KB

          MD5

          278edbd499374bf73621f8c1f969d894

          SHA1

          a81170af14747781c5f5f51bb1215893136f0bc0

          SHA256

          c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

          SHA512

          93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

        • C:\Users\Admin\AppData\Roaming\notepad .exe

          Filesize

          52KB

          MD5

          278edbd499374bf73621f8c1f969d894

          SHA1

          a81170af14747781c5f5f51bb1215893136f0bc0

          SHA256

          c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

          SHA512

          93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

        • \Users\Admin\AppData\Local\Temp\Pop4.exe

          Filesize

          31KB

          MD5

          f897f903e4942678ec765a31eda224fb

          SHA1

          dbd82191f21b95abb8db284950059950d4bb780d

          SHA256

          8833df32992ef03eb51c3aec5354be775f15ebdfba9016f1156222b3a7145091

          SHA512

          67a24c55fac905f185658caef3ee2007860546454c624942d85f739612e56ebeb0edd53b91e872693c5adee86b0fa2c35352cf5d57545a7c109791aa60a4c873

        • \Users\Admin\AppData\Roaming\notepad .exe

          Filesize

          52KB

          MD5

          278edbd499374bf73621f8c1f969d894

          SHA1

          a81170af14747781c5f5f51bb1215893136f0bc0

          SHA256

          c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

          SHA512

          93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

        • memory/1296-79-0x0000000001280000-0x0000000001290000-memory.dmp

          Filesize

          64KB

        • memory/1296-87-0x0000000000875000-0x0000000000886000-memory.dmp

          Filesize

          68KB

        • memory/1472-62-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-86-0x00000000748F0000-0x0000000074E9B000-memory.dmp

          Filesize

          5.7MB

        • memory/1472-73-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-69-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-66-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-65-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-75-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-63-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1472-89-0x00000000748F0000-0x0000000074E9B000-memory.dmp

          Filesize

          5.7MB

        • memory/2016-88-0x00000000748F0000-0x0000000074E9B000-memory.dmp

          Filesize

          5.7MB

        • memory/2016-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

          Filesize

          8KB

        • memory/2016-58-0x00000000748F0000-0x0000000074E9B000-memory.dmp

          Filesize

          5.7MB

        • memory/2016-94-0x00000000748F0000-0x0000000074E9B000-memory.dmp

          Filesize

          5.7MB