Analysis

  • max time kernel
    0s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 18:16

General

  • Target

    80C6039DC12399E3F771632F0A44C4C3.exe

  • Size

    1.6MB

  • MD5

    80c6039dc12399e3f771632f0a44c4c3

  • SHA1

    f609ba2e8bc0d4b395b83f38a4867fcdb9b6bfdd

  • SHA256

    f6b10c59c9ce33c5c8f6b02c3293fe5d479e59542698c91b15af74bcce50ab8f

  • SHA512

    83b8fb0f9943c11012a82049d7861a3b7ec9753036de402c82ac433a5235cb95a104dd69b29ed110cd9dfe3b8ab062d916956f6f66864bf79876e926c2c5a6a5

  • SSDEEP

    49152:2dh0Omwse7edN51glfneOTS9rFJMkn4Rli/Ea:2dcwN25efeIS9rF6k4RQM

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

links-transition.gl.at.ply.gg:41958

127.0.0.1:41958

Mutex

973dbaac-5242-4f6a-aaef-307dad24cdde

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2023-10-14T03:00:38.071092836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    41958

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    973dbaac-5242-4f6a-aaef-307dad24cdde

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    links-transition.gl.at.ply.gg

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • Nirsoft 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80C6039DC12399E3F771632F0A44C4C3.exe
    "C:\Users\Admin\AppData\Local\Temp\80C6039DC12399E3F771632F0A44C4C3.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\sanas.scr
      "C:\Users\Admin\AppData\Local\Temp\sanas.scr" /S
      2⤵
        PID:2044
        • C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
          "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
          3⤵
            PID:1136
        • C:\Users\Admin\AppData\Local\Temp\microsofts.exe
          "C:\Users\Admin\AppData\Local\Temp\microsofts.exe"
          2⤵
            PID:3124
            • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
              "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\bo2ezzp0.hxi"
              3⤵
                PID:2896
              • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
                "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\zx0bpzxl.geg"
                3⤵
                  PID:3392
              • C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe
                "C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe"
                2⤵
                • Executes dropped EXE
                PID:4260
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AcABiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AcAB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZQBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAeQBqACMAPgA="
              1⤵
                PID:2268
              • C:\Users\Admin\AppData\Local\Temp\Server.exe
                "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                1⤵
                  PID:944
                  • C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
                    "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
                    2⤵
                      PID:1996
                  • C:\Users\Admin\AppData\Local\Temp\Server2223.exe
                    "C:\Users\Admin\AppData\Local\Temp\Server2223.exe"
                    1⤵
                      PID:672
                    • C:\Windows\system32\OpenWith.exe
                      C:\Windows\system32\OpenWith.exe -Embedding
                      1⤵
                        PID:3712
                      • C:\Windows\system32\OpenWith.exe
                        C:\Windows\system32\OpenWith.exe -Embedding
                        1⤵
                          PID:4432
                        • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe
                          "C:\Users\Admin\AppData\Local\Temp\FreeScript.exe"
                          1⤵
                            PID:3204
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAZQBlACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGoAcQB3ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAaQBmACAAZQByAHIAbwByAHMAIABjAG8AbgB0AGEAYwB0ACAAbQBlACAAbQBhAGkAawBrAGkANAAyADAAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHMAbABwACMAPgA="
                            1⤵
                              PID:4280

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe

                                    Filesize

                                    913KB

                                    MD5

                                    799c188cf6df366f4c0f98b8800a4977

                                    SHA1

                                    161d6006518879ecba6cf45b29599992d8eadfce

                                    SHA256

                                    32e96ac5e9d2f869ad11ca48401ca8eaeb520027751427145ddb5ab43bce1841

                                    SHA512

                                    32a3749f4ef40e9345644c84666207a7c4f0369274cc18f71eecd1eeb6ea22733bc4cc6751f7281bbdff7e0a2187209a6c00653a95d6d39adb4dab06f355e1b1

                                  • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe

                                    Filesize

                                    893KB

                                    MD5

                                    bfb9089bf4cd2ee95a235603efb29895

                                    SHA1

                                    511ad28599d423f16be8cacf3ce60088fe556f51

                                    SHA256

                                    b467b658e82b8d57d736a486bdd02fb20d34ab47da7176feae60dff285033c23

                                    SHA512

                                    df46a060a5ac315969e943ac9b121877ba3a348c2ca8dac34d4fda3ab9bf11bce880bb82761274e88d139f9c8bc8f60c5bae43224833bf50f0414220b4ffc6f0

                                  • C:\Users\Admin\AppData\Local\Temp\Server.exe

                                    Filesize

                                    183KB

                                    MD5

                                    b9d1be8ae4f4a7a77f309b032a914564

                                    SHA1

                                    3b9da974e959adbb0f12705c64fd58e0c8ec5b18

                                    SHA256

                                    5f9c9f9af0dc5779d63ea334443d512d675b99c588f2505b652d49d02650c3ba

                                    SHA512

                                    dfadf27f176fe700df9dd9a979e030d362e906a25815eccb1a40c09d8dfee542a75ababbc361833742891fd5d0358233ad68cac05c12aedca1e5d93ae370fc14

                                  • C:\Users\Admin\AppData\Local\Temp\Server2223.exe

                                    Filesize

                                    93KB

                                    MD5

                                    86757f6c08b6cb698250cc9fc1816a8e

                                    SHA1

                                    fa8a2fbc982943a031ad202b3e4b1cdb11bcff6a

                                    SHA256

                                    98fa9c5139362be3e25333a7c48229ed220cc61c0dc41b8270e66d2886aa7dff

                                    SHA512

                                    cb87cf73deda4299561af9e7c4d65a82816ca5f82890edd76cfec258dbf973b197cd6c40bca2f8643d39f451072e71c5f9529864689cc68097a4382bec97a7dc

                                  • C:\Users\Admin\AppData\Local\Temp\bo2ezzp0.hxi

                                    Filesize

                                    3KB

                                    MD5

                                    02524418240369b25b988e9884cd1c54

                                    SHA1

                                    42a33322d952edf6d8431d4cd788bbc863d2b890

                                    SHA256

                                    80b2a0874c2f734dfe1196d7ae2a7bc6ccb30df2d9281513ac33edc529a71a37

                                    SHA512

                                    7c5bbe911f7f0b072d6fdb89ea5759655c2b5cf9ebfddff8f2f67f956141b8ed3697ab0504f60c3992849afbbc79434043a6c04d7cf6ddd958e23354fd3a698f

                                  • C:\Users\Admin\AppData\Local\Temp\microsofts.exe

                                    Filesize

                                    202KB

                                    MD5

                                    5fdd418baf9c0d789e67758ad9f2dd1a

                                    SHA1

                                    c0be3be193af670cfe01a64aef7c5b0a0b9d091a

                                    SHA256

                                    82f59d1a1a65c0651ae7a965bb6481ba1351ea9efc9f9457de372043709e5a47

                                    SHA512

                                    9ace7aed4e4db6f2df7a8df22227079acf176cb7b7e90a0d2638dfd44296653fae6194531a7335fb10fd9396f3cd4f11621715b2a2e4f948209055a809b00c50

                                  • C:\Users\Admin\AppData\Local\Temp\sanas.scr

                                    Filesize

                                    183KB

                                    MD5

                                    b7cedaa564e3fb095f94aef59f7ed0da

                                    SHA1

                                    3f93a84f2d290840cfb5418e15c47dda39ab967d

                                    SHA256

                                    526a5aae8d6af5d4af48bef2bf37f6a79b1584b7b48d32bef6a2f6f4ee69ccfc

                                    SHA512

                                    18d274dba047179d7cc6b2bb14ede76618bf5c93d8a4b4d1a32bbcf2f6494c9ecc4a601a5a4eae5d7672967be5c3a0c5bfc402f97626638ba7825d6412538f7d

                                  • C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe

                                    Filesize

                                    1.2MB

                                    MD5

                                    4c624867a94fee20d81b9e14755165de

                                    SHA1

                                    6f5afb06ff6278616f8fb0cd81ad1e164b0fee24

                                    SHA256

                                    9a1ef7b5af62c005df90a75846e390e1695ecd18c7727b8e039e4b5842d6f388

                                    SHA512

                                    0a40dc67d116b9726c3129a88e82c536273b4ad42f850ca78828b042dc5d20313caf1ee8a8a7136efab6027fa2f7bcf1551fac61f239c10d865f5664a8006064

                                  • C:\Users\Admin\AppData\Local\Temp\zx0bpzxl.geg

                                    Filesize

                                    523B

                                    MD5

                                    69b2a2e17e78d24abee9f1de2f04811a

                                    SHA1

                                    d19c109704e83876ab3527457f9418a7d053aa33

                                    SHA256

                                    1b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd

                                    SHA512

                                    eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f

                                  • memory/672-64-0x0000000073790000-0x0000000073D41000-memory.dmp

                                    Filesize

                                    5.7MB

                                  • memory/672-66-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/672-75-0x0000000073790000-0x0000000073D41000-memory.dmp

                                    Filesize

                                    5.7MB

                                  • memory/944-73-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/944-117-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/944-62-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/944-109-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/944-71-0x000000001D240000-0x000000001D54E000-memory.dmp

                                    Filesize

                                    3.1MB

                                  • memory/944-54-0x000000001C120000-0x000000001C1BC000-memory.dmp

                                    Filesize

                                    624KB

                                  • memory/944-59-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1136-125-0x0000000001370000-0x0000000001380000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1136-123-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/1136-122-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/1996-132-0x000000001F430000-0x000000001F530000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/1996-131-0x00000000011E0000-0x00000000011F0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1996-116-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/1996-121-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/1996-120-0x00000000011E0000-0x00000000011F0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2044-61-0x000000001C260000-0x000000001C2AC000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/2044-53-0x00000000010C0000-0x00000000010D0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2044-45-0x000000001B590000-0x000000001B636000-memory.dmp

                                    Filesize

                                    664KB

                                  • memory/2044-51-0x000000001BB10000-0x000000001BFDE000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/2044-57-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/2044-60-0x0000000000E90000-0x0000000000E98000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/2044-135-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/2044-52-0x00007FF862EE0000-0x00007FF863881000-memory.dmp

                                    Filesize

                                    9.6MB

                                  • memory/2268-159-0x0000000007C60000-0x0000000007C71000-memory.dmp

                                    Filesize

                                    68KB

                                  • memory/2268-68-0x0000000005160000-0x0000000005170000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2268-166-0x0000000074060000-0x0000000074810000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2268-77-0x0000000005F90000-0x0000000005FB2000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/2268-88-0x0000000074060000-0x0000000074810000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2268-69-0x0000000005160000-0x0000000005170000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2268-160-0x0000000007CA0000-0x0000000007CAE000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/2268-162-0x0000000007DA0000-0x0000000007DBA000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/2268-163-0x0000000007D80000-0x0000000007D88000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/2268-161-0x0000000007CB0000-0x0000000007CC4000-memory.dmp

                                    Filesize

                                    80KB

                                  • memory/2268-158-0x0000000007CE0000-0x0000000007D76000-memory.dmp

                                    Filesize

                                    600KB

                                  • memory/2268-157-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/2268-141-0x000000007F0C0000-0x000000007F0D0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2268-142-0x00000000076F0000-0x0000000007722000-memory.dmp

                                    Filesize

                                    200KB

                                  • memory/2268-154-0x00000000076B0000-0x00000000076CE000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/2268-143-0x000000006EA30000-0x000000006EA7C000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/2268-155-0x0000000007930000-0x00000000079D3000-memory.dmp

                                    Filesize

                                    652KB

                                  • memory/2896-200-0x0000000000460000-0x0000000000529000-memory.dmp

                                    Filesize

                                    804KB

                                  • memory/2896-201-0x0000000000400000-0x0000000000453000-memory.dmp

                                    Filesize

                                    332KB

                                  • memory/2896-194-0x0000000000400000-0x0000000000453000-memory.dmp

                                    Filesize

                                    332KB

                                  • memory/2896-192-0x0000000000400000-0x0000000000453000-memory.dmp

                                    Filesize

                                    332KB

                                  • memory/3124-67-0x0000000001350000-0x0000000001360000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3124-156-0x0000000073790000-0x0000000073D41000-memory.dmp

                                    Filesize

                                    5.7MB

                                  • memory/3124-27-0x0000000001350000-0x0000000001360000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3124-70-0x0000000073790000-0x0000000073D41000-memory.dmp

                                    Filesize

                                    5.7MB

                                  • memory/3124-22-0x0000000073790000-0x0000000073D41000-memory.dmp

                                    Filesize

                                    5.7MB

                                  • memory/3124-168-0x0000000001350000-0x0000000001360000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3392-185-0x0000000000400000-0x000000000041B000-memory.dmp

                                    Filesize

                                    108KB

                                  • memory/3392-187-0x0000000000400000-0x000000000041B000-memory.dmp

                                    Filesize

                                    108KB

                                  • memory/4280-124-0x0000000005E30000-0x0000000005E4E000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/4280-78-0x0000000004A70000-0x0000000004A80000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4280-83-0x00000000057F0000-0x0000000005856000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/4280-82-0x0000000004A70000-0x0000000004A80000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4280-144-0x0000000007290000-0x0000000007322000-memory.dmp

                                    Filesize

                                    584KB

                                  • memory/4280-89-0x0000000005860000-0x0000000005BB4000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/4280-167-0x0000000074060000-0x0000000074810000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/4280-126-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/4280-81-0x00000000056E0000-0x0000000005746000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/4280-136-0x00000000073F0000-0x0000000007A6A000-memory.dmp

                                    Filesize

                                    6.5MB

                                  • memory/4280-137-0x0000000006360000-0x000000000637A000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/4280-65-0x00000000050B0000-0x00000000056D8000-memory.dmp

                                    Filesize

                                    6.2MB

                                  • memory/4280-140-0x0000000008020000-0x00000000085C4000-memory.dmp

                                    Filesize

                                    5.6MB

                                  • memory/4280-63-0x0000000002570000-0x00000000025A6000-memory.dmp

                                    Filesize

                                    216KB

                                  • memory/4280-76-0x0000000074060000-0x0000000074810000-memory.dmp

                                    Filesize

                                    7.7MB