Analysis

  • max time kernel
    137s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    30-03-2023 09:01

General

  • Target

    5bd6af6f395bd4d577b0d3c97bc58195.scr.exe

  • Size

    1.1MB

  • MD5

    b15216131833ae02f4f05d5bb4dfea43

  • SHA1

    dc09861f62b55e50be77a1588a997adf9b80e410

  • SHA256

    2ef9e0b5a402e96b775bb1701741bb8af269dd6346b96827681da12912a55b8a

  • SHA512

    85961d8b04687f7cb70eecce082e82198fcdbb6093a1ef34f8fe12a69b41c3f3cc05e388162d3d89f160fa63e807d62a6a5fefd1587db44d0f27c1bd8a107633

  • SSDEEP

    24576:lTbBv5rUaUUUUUJUUUUUUJDDpvm6tTjloM8WZQ6k+5zUMel:PBLUUUUUJUUUUUUFDpvYMdqwFUMM

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

december2n.duckdns.org:40111

december2nd.ddns.net:40111

Mutex

32ca6e6e-2fe0-4ef5-a3ea-5de451e80042

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    december2nd.ddns.net

  • backup_dns_server

  • buffer_size

    65538

  • build_time

    2022-11-26T05:13:34.059050336Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    40111

  • default_group

    mama

  • enable_debug_mode

    true

  • gc_threshold

    1.0485772e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.0485772e+07

  • mutex

    32ca6e6e-2fe0-4ef5-a3ea-5de451e80042

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    december2n.duckdns.org

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    false

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8009

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5bd6af6f395bd4d577b0d3c97bc58195.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\5bd6af6f395bd4d577b0d3c97bc58195.scr.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" Update-db.q.vbe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
        "C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif" jmapn.msc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp49ED.tmp"
            5⤵
            • Creates scheduled task(s)
            PID:384
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4C7D.tmp"
            5⤵
            • Creates scheduled task(s)
            PID:1592

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    Filesize

    44KB

    MD5

    0e06054beb13192588e745ee63a84173

    SHA1

    30b7d4d1277bafd04a83779fd566a1f834a8d113

    SHA256

    c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

    SHA512

    251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

  • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    Filesize

    44KB

    MD5

    0e06054beb13192588e745ee63a84173

    SHA1

    30b7d4d1277bafd04a83779fd566a1f834a8d113

    SHA256

    c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

    SHA512

    251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

  • C:\Users\Admin\AppData\Local\Temp\ppfr\jmapn.msc
    Filesize

    83.2MB

    MD5

    027fcff6a3d87f462e20830ac8e3514f

    SHA1

    f8ccc5c999f380c02617dd9a342fb4e6f8aa1389

    SHA256

    0ebdc3485e0b7208f43d2cc85fa841f528f74fab9d3fd90ddbee1b4eff2e17d5

    SHA512

    cbc01e13eaf6619264a46b03237f8f84af0df364581252de45d8cee7ee0757afdac23e6a740e87f0817c660bad02163d4ef1ab3f76d10347f52406fe2e8e910d

  • C:\Users\Admin\AppData\Local\Temp\ppfr\mbmuovrk.vmb
    Filesize

    397KB

    MD5

    47a3760694424f080062061971c9e2ae

    SHA1

    107b8682b9322ee4886ade154c88c3cfebd24ae9

    SHA256

    2a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad

    SHA512

    31d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655

  • C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
    Filesize

    1.1MB

    MD5

    164ad61662d4c1689360b3e088f2152f

    SHA1

    c2a2e463a82845171f746d25932b25880d49f7fe

    SHA256

    1a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e

    SHA512

    c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc

  • C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
    Filesize

    1.1MB

    MD5

    164ad61662d4c1689360b3e088f2152f

    SHA1

    c2a2e463a82845171f746d25932b25880d49f7fe

    SHA256

    1a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e

    SHA512

    c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc

  • C:\Users\Admin\AppData\Local\Temp\ppfr\vjmptakx.icm
    Filesize

    37KB

    MD5

    ae0c231ca889212f0bad108625ad4514

    SHA1

    a9bce3322991fcf993ad466ea78637eecd624db9

    SHA256

    7c11fef67f06f18a2d5a949029c9ac362f40cd3f1f13e74336473fd65d327a42

    SHA512

    5016270c7493360d8019e074e2e3c8382eea4384b63ea188ecf6a97d45a706f0a3d3621071479b3f15bb0e596dbc376c8d9d8c99d269e063fed046e621be18d6

  • C:\Users\Admin\AppData\Local\Temp\tmp49ED.tmp
    Filesize

    1KB

    MD5

    95aceabc58acad5d73372b0966ee1b35

    SHA1

    2293b7ad4793cf574b1a5220e85f329b5601040a

    SHA256

    8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4

    SHA512

    00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74

  • C:\Users\Admin\AppData\Local\Temp\tmp4C7D.tmp
    Filesize

    1KB

    MD5

    677848190631e19222304d1982aa2e1b

    SHA1

    bed6cf97d3458e4ea59ff9823375d915a9b3d682

    SHA256

    8bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d

    SHA512

    f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e

  • C:\Users\Admin\AppData\Local\temp\ppfr\Update-db.q.vbe
    Filesize

    60KB

    MD5

    adf0a90a776e28ce256b5bcef92dc40c

    SHA1

    85d5b78d08df5ab38a70ac372dda075424f1a886

    SHA256

    ee53ad078ffa7b36eb1f71f5a4dfdb5e945c4aad6d8af78bf780be19c27c3ee7

    SHA512

    078c3b432854aa9d0bd0673e60e0515e2a9e35e70f826835424ac7da76ba48c8dd3840b5960cfab6149d3739e5c35744f3628a2f08523033c6b0a1addb8ab410

  • \Users\Admin\AppData\Local\Temp\RegSvcs.exe
    Filesize

    44KB

    MD5

    0e06054beb13192588e745ee63a84173

    SHA1

    30b7d4d1277bafd04a83779fd566a1f834a8d113

    SHA256

    c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

    SHA512

    251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

  • \Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
    Filesize

    1.1MB

    MD5

    164ad61662d4c1689360b3e088f2152f

    SHA1

    c2a2e463a82845171f746d25932b25880d49f7fe

    SHA256

    1a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e

    SHA512

    c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc

  • memory/872-141-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/872-164-0x00000000010B0000-0x00000000010C2000-memory.dmp
    Filesize

    72KB

  • memory/872-145-0x00000000003B0000-0x0000000000858000-memory.dmp
    Filesize

    4.7MB

  • memory/872-149-0x00000000003B0000-0x00000000003EA000-memory.dmp
    Filesize

    232KB

  • memory/872-151-0x0000000004730000-0x0000000004770000-memory.dmp
    Filesize

    256KB

  • memory/872-142-0x00000000003B0000-0x0000000000858000-memory.dmp
    Filesize

    4.7MB

  • memory/872-140-0x00000000003B0000-0x0000000000858000-memory.dmp
    Filesize

    4.7MB

  • memory/872-158-0x00000000002A0000-0x00000000002AA000-memory.dmp
    Filesize

    40KB

  • memory/872-159-0x00000000009F0000-0x00000000009FC000-memory.dmp
    Filesize

    48KB

  • memory/872-160-0x0000000001050000-0x000000000106E000-memory.dmp
    Filesize

    120KB

  • memory/872-161-0x0000000000E00000-0x0000000000E0A000-memory.dmp
    Filesize

    40KB

  • memory/872-147-0x00000000003B0000-0x0000000000858000-memory.dmp
    Filesize

    4.7MB

  • memory/872-165-0x00000000024E0000-0x00000000024FA000-memory.dmp
    Filesize

    104KB

  • memory/872-166-0x0000000002500000-0x000000000250E000-memory.dmp
    Filesize

    56KB

  • memory/872-167-0x0000000002520000-0x0000000002532000-memory.dmp
    Filesize

    72KB

  • memory/872-168-0x0000000002570000-0x000000000257E000-memory.dmp
    Filesize

    56KB

  • memory/872-169-0x00000000047B0000-0x00000000047BC000-memory.dmp
    Filesize

    48KB

  • memory/872-170-0x0000000004900000-0x0000000004914000-memory.dmp
    Filesize

    80KB

  • memory/872-171-0x0000000004910000-0x0000000004920000-memory.dmp
    Filesize

    64KB

  • memory/872-172-0x0000000004FD0000-0x0000000004FE4000-memory.dmp
    Filesize

    80KB

  • memory/872-173-0x0000000004FF0000-0x0000000004FFE000-memory.dmp
    Filesize

    56KB

  • memory/872-174-0x0000000005160000-0x000000000518E000-memory.dmp
    Filesize

    184KB

  • memory/872-175-0x00000000051D0000-0x00000000051E4000-memory.dmp
    Filesize

    80KB

  • memory/872-177-0x0000000004730000-0x0000000004770000-memory.dmp
    Filesize

    256KB