Overview

overview

10

Static

static

10

NanoCore.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NanoCore.exe

  • Size

    1.1MB

  • Sample

    230410-rwxq5saa35

  • MD5

    e4aeb7b31d677a5a9a58a4762fab1321

  • SHA1

    a5e7279b6d59236296031ff87976e33fbd8cf34d

  • SHA256

    1111f013a010a57a6739a8d4d0891728547cbbf80e45e77369a05d3423a28915

  • SHA512

    964dda5030a54493aeebb8b478a76ccd98456184224332e66d5b693d311c83da11c360355c8d73e539ebc7b6ed0d0d2e78f65eef0f75d48c64a63cf10411e1fa

  • SSDEEP

    24576:sdZ1xuVVjfFoynPaVBUR8f+kN10EBIQXiClSI5tIkjh:snQDgok30Edb

Score
10/10
darkcometnanocoreidmanevasionkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

darkcomet

Botnet

IDMAN

C2

arrivals.ddns.net:2323

Mutex

DC_MUTEX-391X2ZJ

Attributes
  • InstallPath

    MSDCSC\IDMAN.exe

  • gencode

    CUWbhGwmWBMb

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    IDMAN

Targets

    • Target

      NanoCore.exe

    • Size

      1.1MB

    • MD5

      e4aeb7b31d677a5a9a58a4762fab1321

    • SHA1

      a5e7279b6d59236296031ff87976e33fbd8cf34d

    • SHA256

      1111f013a010a57a6739a8d4d0891728547cbbf80e45e77369a05d3423a28915

    • SHA512

      964dda5030a54493aeebb8b478a76ccd98456184224332e66d5b693d311c83da11c360355c8d73e539ebc7b6ed0d0d2e78f65eef0f75d48c64a63cf10411e1fa

    • SSDEEP

      24576:sdZ1xuVVjfFoynPaVBUR8f+kN10EBIQXiClSI5tIkjh:snQDgok30Edb

    Score
    10/10
    darkcometnanocoreidmanevasionkeyloggerpersistenceratspywarestealertrojan
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks