Analysis

  • max time kernel
    3s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 18:26

General

  • Target

    840ef8d2d1936ebf66e63f85c7dece42.exe

  • Size

    1.9MB

  • MD5

    840ef8d2d1936ebf66e63f85c7dece42

  • SHA1

    f4770a5e987d15d1615c40ef40f3a96098c0e8c2

  • SHA256

    6dad4f5325f635039e443e725ddaf3eb210952b0ebe81027dae9f9fb0a09e831

  • SHA512

    91443a07773e48dff09cc5ff768278c54690b45dd1d9519c49f9eb51eca928f2a55a9388aafc66584ca4d12b6f6ec8516ac133b6b562972e7cf71ecd3d41ad43

  • SSDEEP

    6144:hl4uX/nkpB6i+WCWm9R+bM3WIVc7giHomaXXxB6IoeO0nSW/iYPEeuCZAA2iPIZd:hPtsU+bYWqBRoeT//iKsKtb

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

omaprilcode.duckdns.org:8090

Mutex

f8dffc54-5ec5-4013-9de8-d8d853682f44

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    omaprilcode.duckdns.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-01-26T15:04:24.913843336Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    8090

  • default_group

    CODEDBASE

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    f8dffc54-5ec5-4013-9de8-d8d853682f44

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    omaprilcode.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Windows security bypass 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe
    "C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe"
    1⤵
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    PID:3624
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\IfB44785yo4aR44dco3pdD14W\svchost.exe" -Force
      2⤵
        PID:1712
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\IfB44785yo4aR44dco3pdD14W\svchost.exe" -Force
        2⤵
          PID:4500
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe" -Force
          2⤵
            PID:2336
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout 1
            2⤵
              PID:1580
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2460
            • C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe
              "C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe"
              2⤵
                PID:1372
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1608
                2⤵
                • Program crash
                PID:2108
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3624 -ip 3624
              1⤵
                PID:4932

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      968cb9309758126772781b83adb8a28f

                      SHA1

                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                      SHA256

                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                      SHA512

                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      83e783907e18e90f5e5e6aebc34f2ac5

                      SHA1

                      038aeadb925b5c455993ec1a6f5765099ba7b5c7

                      SHA256

                      315ae4165153e728b2e8aae5d68b310cf4d9f4f9dc181856b68f5bfeba67c5cd

                      SHA512

                      e4352c19f29fec832b1403e35a280dd788734b16863fed363c18aafb5e3cdc36e9525a7d38727fc000dfa317f9b180983fce82a443e544aeba89c4e0c740fb72

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      7f373306d581126483e9abb53e2c6d9c

                      SHA1

                      a4224e6c111a120684726d13b66185b03929b438

                      SHA256

                      3d779c72a91d1c808d48468a72d7ce6bfb310f0797d1145ff86e8ae7e4e1c74d

                      SHA512

                      6f4db363a8ad5975dfbe83109024f8a0a43996527a9d6ac3cf4e82eff573038dded42996736f0b71f35fdc8188e218f82e2aa72b6f1e20597d9e4833ea04e815

                    • memory/1372-122-0x0000000005C60000-0x0000000005C70000-memory.dmp

                      Filesize

                      64KB

                    • memory/1372-121-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1372-117-0x0000000005AE0000-0x0000000005AEA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1372-119-0x0000000005FA0000-0x0000000005FAA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1372-112-0x0000000000400000-0x000000000043A000-memory.dmp

                      Filesize

                      232KB

                    • memory/1372-113-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1372-115-0x0000000005C60000-0x0000000005C70000-memory.dmp

                      Filesize

                      64KB

                    • memory/1372-118-0x0000000005F60000-0x0000000005F7E000-memory.dmp

                      Filesize

                      120KB

                    • memory/1712-12-0x0000000000900000-0x0000000000910000-memory.dmp

                      Filesize

                      64KB

                    • memory/1712-111-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1712-11-0x0000000004CB0000-0x00000000052D8000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/1712-15-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

                      Filesize

                      136KB

                    • memory/1712-26-0x0000000005450000-0x00000000054B6000-memory.dmp

                      Filesize

                      408KB

                    • memory/1712-13-0x0000000000900000-0x0000000000910000-memory.dmp

                      Filesize

                      64KB

                    • memory/1712-9-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1712-83-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1712-99-0x0000000006FE0000-0x0000000006FF4000-memory.dmp

                      Filesize

                      80KB

                    • memory/1712-97-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

                      Filesize

                      68KB

                    • memory/1712-51-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

                      Filesize

                      120KB

                    • memory/1712-82-0x0000000070170000-0x00000000701BC000-memory.dmp

                      Filesize

                      304KB

                    • memory/1712-52-0x0000000005F20000-0x0000000005F6C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1712-7-0x00000000021C0000-0x00000000021F6000-memory.dmp

                      Filesize

                      216KB

                    • memory/1712-53-0x0000000000900000-0x0000000000910000-memory.dmp

                      Filesize

                      64KB

                    • memory/2336-60-0x0000000070170000-0x00000000701BC000-memory.dmp

                      Filesize

                      304KB

                    • memory/2336-100-0x0000000007D50000-0x0000000007D6A000-memory.dmp

                      Filesize

                      104KB

                    • memory/2336-14-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2336-110-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2336-25-0x0000000002E20000-0x0000000002E30000-memory.dmp

                      Filesize

                      64KB

                    • memory/2336-101-0x0000000007D30000-0x0000000007D38000-memory.dmp

                      Filesize

                      32KB

                    • memory/2336-55-0x0000000002E20000-0x0000000002E30000-memory.dmp

                      Filesize

                      64KB

                    • memory/2336-18-0x0000000002E20000-0x0000000002E30000-memory.dmp

                      Filesize

                      64KB

                    • memory/2336-19-0x0000000006010000-0x0000000006076000-memory.dmp

                      Filesize

                      408KB

                    • memory/2336-94-0x0000000007A10000-0x0000000007A2A000-memory.dmp

                      Filesize

                      104KB

                    • memory/2336-93-0x0000000008050000-0x00000000086CA000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/2336-96-0x0000000007C90000-0x0000000007D26000-memory.dmp

                      Filesize

                      600KB

                    • memory/2336-56-0x000000007F8D0000-0x000000007F8E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2336-57-0x0000000007680000-0x00000000076B2000-memory.dmp

                      Filesize

                      200KB

                    • memory/3624-114-0x0000000006C30000-0x0000000006C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/3624-1-0x00000000003F0000-0x00000000005E2000-memory.dmp

                      Filesize

                      1.9MB

                    • memory/3624-3-0x0000000004FD0000-0x000000000506C000-memory.dmp

                      Filesize

                      624KB

                    • memory/3624-120-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/3624-71-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/3624-2-0x0000000005490000-0x0000000005A34000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/3624-4-0x0000000006C30000-0x0000000006C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/3624-5-0x0000000004F30000-0x0000000004FD2000-memory.dmp

                      Filesize

                      648KB

                    • memory/3624-8-0x0000000008480000-0x0000000008512000-memory.dmp

                      Filesize

                      584KB

                    • memory/3624-10-0x0000000007190000-0x000000000719A000-memory.dmp

                      Filesize

                      40KB

                    • memory/3624-0-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4500-17-0x0000000002CF0000-0x0000000002D00000-memory.dmp

                      Filesize

                      64KB

                    • memory/4500-16-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4500-31-0x0000000002CF0000-0x0000000002D00000-memory.dmp

                      Filesize

                      64KB

                    • memory/4500-58-0x0000000070170000-0x00000000701BC000-memory.dmp

                      Filesize

                      304KB

                    • memory/4500-50-0x00000000061D0000-0x0000000006524000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4500-81-0x0000000007660000-0x0000000007703000-memory.dmp

                      Filesize

                      652KB

                    • memory/4500-107-0x0000000074C80000-0x0000000075430000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4500-54-0x0000000002CF0000-0x0000000002D00000-memory.dmp

                      Filesize

                      64KB

                    • memory/4500-95-0x00000000077F0000-0x00000000077FA000-memory.dmp

                      Filesize

                      40KB

                    • memory/4500-98-0x0000000007BC0000-0x0000000007BCE000-memory.dmp

                      Filesize

                      56KB

                    • memory/4500-70-0x0000000006C20000-0x0000000006C3E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4500-59-0x000000007F070000-0x000000007F080000-memory.dmp

                      Filesize

                      64KB