Resubmissions
14-11-2023 17:31
231114-v3qg7acf42 1014-11-2023 17:21
231114-vxdw7sdg61 1028-10-2023 19:29
231028-x7cs1age56 1024-10-2023 13:29
231024-qrn3rsdb6z 1018-10-2023 12:04
231018-n8ybnaeb31 1007-09-2023 12:10
230907-pce1wahe2x 10Analysis
-
max time kernel
1811s -
max time network
1819s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18-10-2023 12:04
General
-
Target
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe
-
Size
1.7MB
-
MD5
61b26f24a7c056f8224f89d90204b3f7
-
SHA1
b2ea41a5457b1d0b7528288aa586449e448db235
-
SHA256
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112
-
SHA512
99d9690741f0543e44f6acd26574d67e54139af92179e7455b4d3f0d1a0a75ff2205b6a8c512a1048eaacd65403cbbb742b59e0611acc11a9085b67b73be2e24
-
SSDEEP
49152:ih+ZkldoPKi2aFYv89an4TJ/jG3R8xve/RG0n:72cPKiSk97bG3R8xWR
Malware Config
Extracted
nanocore
1.2.2.0
185.244.30.114:2404
822e1333-5c33-4c42-9d46-9e51dfe00457
-
activate_away_mode
true
-
backup_connection_host
185.244.30.114
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-12-17T02:26:47.689583036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2404
-
default_group
1234
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
822e1333-5c33-4c42-9d46-9e51dfe00457
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.244.30.114
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe"C:\Users\Admin\AppData\Local\Temp\784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5d39eef3961ff1ba7c4d3eb87f684bbb0
SHA11beb2992bb4b5a6b58916d4b7defd660c0410ca6
SHA25619c49fd58eb2a9afff184bb73cf8325d1780800bf2526d13af0d2d5ddb048efd
SHA512c49fdd2925e6487a174b728c3e562bd0fc0f9399cc955ac56f1ad1922b2c256bf27070c1ee960dae6a728f0bec3db948704f7995b537d2b89e522fbce52885a9
-
Filesize
224KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB