Overview

overview

10

Static

static

10

be22f6fdca...a1.exe

windows7-x64

10

be22f6fdca...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be22f6fdcaccb638c1e9f91b5bb5bab136e1697e4ac7b01df34f5d7ccf1e5ca1

  • Size

    211KB

  • Sample

    221128-xj23zsch4y

  • MD5

    d3db5d801a8f633f8e8a912f8ffb06d0

  • SHA1

    23ee7d83d23033ccf2db2a0cf360dc4ccc7b1f35

  • SHA256

    be22f6fdcaccb638c1e9f91b5bb5bab136e1697e4ac7b01df34f5d7ccf1e5ca1

  • SHA512

    85d3d729ae73e725b3524dc3cca59244259850b141403dd1a0bc2e39769675b02ecdaf78c9a79f2adcb8ab465dcddf79cefe6fd6e6eac525d8bfc270a97d150b

  • SSDEEP

    6144:/bpUyVszXOTsDyR4NZwY4fuc5rjunzsq7MJzm:/tsDO4UA6Y4fp3ungqJ

Score
10/10
nanocoreevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.1.1

C2

testdomain1.chickenkiller.com:9033

Mutex

bc3e8b2c-01e5-4031-b4b4-6dfe5f73429b

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    testdomain1.chickenkiller.com

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2014-11-29T05:20:03.250314136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    9033

  • default_group

    Purchased Bots

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    bc3e8b2c-01e5-4031-b4b4-6dfe5f73429b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    testdomain1.chickenkiller.com

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.1.1

  • wan_timeout

    8000

Targets

    • Target

      be22f6fdcaccb638c1e9f91b5bb5bab136e1697e4ac7b01df34f5d7ccf1e5ca1

    • Size

      211KB

    • MD5

      d3db5d801a8f633f8e8a912f8ffb06d0

    • SHA1

      23ee7d83d23033ccf2db2a0cf360dc4ccc7b1f35

    • SHA256

      be22f6fdcaccb638c1e9f91b5bb5bab136e1697e4ac7b01df34f5d7ccf1e5ca1

    • SHA512

      85d3d729ae73e725b3524dc3cca59244259850b141403dd1a0bc2e39769675b02ecdaf78c9a79f2adcb8ab465dcddf79cefe6fd6e6eac525d8bfc270a97d150b

    • SSDEEP

      6144:/bpUyVszXOTsDyR4NZwY4fuc5rjunzsq7MJzm:/tsDO4UA6Y4fp3ungqJ

    Score
    10/10
    nanocoreevasionkeyloggerspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks