Behavioral task
behavioral1
Sample
DC1635104FF64D96E711BBE22D2EE026B01D36F10A845.exe
Resource
win7-20231201-en
General
-
Target
DC1635104FF64D96E711BBE22D2EE026B01D36F10A845.exe
-
Size
256KB
-
MD5
6c4c641da1827270afc02e0536a2ebdf
-
SHA1
e0cb971ecb7660ab3135efec6c944182cbbb89e9
-
SHA256
dc1635104ff64d96e711bbe22d2ee026b01d36f10a84555f75b1a4634d34108f
-
SHA512
156aa7ad3e66f76a9f0d7b5d718489d3fb353870ba40d5188e58c952f91e172083501b8e9eb2adeae8293ac61f09d27a6e52a538cbeb63cb668004b5f21f9ecb
-
SSDEEP
6144:74UxiRC0RTpLFY9bNMXa0TQgotmKH6TjutEKyK:7PiRCGFWSDMD36WF
Malware Config
Extracted
nanocore
1.2.2.0
anunankis1.duckdns.org:5555
anunankis111.duckdns.org:5555
789ea976-4764-42b8-bdd6-bb2daf670706
-
activate_away_mode
false
-
backup_connection_host
anunankis111.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-04-24T16:49:53.113764136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5555
-
default_group
.......TOOL-13-07-23
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
789ea976-4764-42b8-bdd6-bb2daf670706
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
anunankis1.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Nanocore family
-
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DC1635104FF64D96E711BBE22D2EE026B01D36F10A845.exe
Files
-
DC1635104FF64D96E711BBE22D2EE026B01D36F10A845.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ