General
-
Target
c5780f70f04fb5c1751ada457dcd37cacfaeded64d4b7cedfb8e9a458147ac3d
-
Size
5.0MB
-
Sample
221127-qmyfmsah32
-
MD5
55baa82b2d73e2cd120eb25734938eab
-
SHA1
d97d0f7bc31ac059d81a907144b9e1e6e54ab1d1
-
SHA256
c5780f70f04fb5c1751ada457dcd37cacfaeded64d4b7cedfb8e9a458147ac3d
-
SHA512
61026b132739e0d48859f59873b5fa396411012a283dd207fb77f625984041fa4971e8e260e16510630c1772abcd36a97b0e159617bd4de0389dbcf875017703
-
SSDEEP
98304:uD8KUNVaZSRisKY4ZP2evD0jAIXQqxk5tTRAmCGpFFmcbj:/nKY42evD0japFbj
Static task
static1
Behavioral task
behavioral1
Sample
c5780f70f04fb5c1751ada457dcd37cacfaeded64d4b7cedfb8e9a458147ac3d.exe
Resource
win7-20220812-en
Malware Config
Extracted
nanocore
1.2.2.0
nrsi.twilightparadox.com:6765
127.0.0.1:6765
b89d115a-97a0-487f-80f7-751d549eb8aa
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2014-12-19T14:32:21.105256036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6765
-
default_group
09/03/2015
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b89d115a-97a0-487f-80f7-751d549eb8aa
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
nrsi.twilightparadox.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
c5780f70f04fb5c1751ada457dcd37cacfaeded64d4b7cedfb8e9a458147ac3d
-
Size
5.0MB
-
MD5
55baa82b2d73e2cd120eb25734938eab
-
SHA1
d97d0f7bc31ac059d81a907144b9e1e6e54ab1d1
-
SHA256
c5780f70f04fb5c1751ada457dcd37cacfaeded64d4b7cedfb8e9a458147ac3d
-
SHA512
61026b132739e0d48859f59873b5fa396411012a283dd207fb77f625984041fa4971e8e260e16510630c1772abcd36a97b0e159617bd4de0389dbcf875017703
-
SSDEEP
98304:uD8KUNVaZSRisKY4ZP2evD0jAIXQqxk5tTRAmCGpFFmcbj:/nKY42evD0japFbj
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-