Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 05:42

General

  • Target

    768a83faefcdc81b408b09df7ed89395.exe

  • Size

    7.6MB

  • MD5

    768a83faefcdc81b408b09df7ed89395

  • SHA1

    5b7667574ef61d4b2003c819e87d6040a0b56f22

  • SHA256

    ebd4fcb03911f9f6d4ba31386e21881841c98591e78a539f976110b2ff7e8f05

  • SHA512

    abf219f8acc403fdef57d72f71c3523a610487ddd3bf543f413ce6b44fe2a76a3b016f63c48fd381e9b97fc336aaf19bc30ae2ac175becabf59f24fb399fc188

  • SSDEEP

    196608:YtPu+xXrI2bFvKQYs0TMDfzJppk2HDS2M0hdeJfVFUxri:6RrPFPYsJDdg2HGd00fzuri

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

sabifati34.duckdns.org:54984

kingspy.mywire.org:54984

Mutex

3c8bcba0-4059-4b34-be57-f36406e41f3b

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    kingspy.mywire.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-08-31T22:25:34.564478236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    ofis

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    3c8bcba0-4059-4b34-be57-f36406e41f3b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    sabifati34.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe
    "C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Roaming\32bit Patch.exe
      "C:\Users\Admin\AppData\Roaming\32bit Patch.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2356
    • C:\Users\Admin\AppData\Roaming\11.exe
      "C:\Users\Admin\AppData\Roaming\11.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2776 -s 516
        3⤵
        • Loads dropped DLL
        PID:1636
    • C:\Users\Admin\AppData\Roaming\nan0.exe
      "C:\Users\Admin\AppData\Roaming\nan0.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\11.exe

    Filesize

    2.3MB

    MD5

    941f6c12cef77bc88218c384d12d6ff0

    SHA1

    cc38714927b2572fe448f51c8cfc605102a88fd9

    SHA256

    6a821b75ab9e5e3176d2c0d073d31f77695900f361611cf657c5be63e5f7cda1

    SHA512

    e2b955b2b7a362f3bcc1f562671f6ac9e25c85f87a31fa155cf7eb8bef4c1cbda7ce09039dd9b5bb4b1d703f363855e7b284d4f6939d32cb370190f3d7bdfb32

  • C:\Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.7MB

    MD5

    8612992452fe0f42f76f33d0320c208c

    SHA1

    aef42d62ec61ab3675767ab87a6a57d6bdf91135

    SHA256

    60d61c61f5db33ea50ec002f0a6d6db988c270876e73c703475e05179b8e35bc

    SHA512

    4b081d881c93ef332bfa060d8bb1a3b648308677a16233bfcd490b7f6423c70006de1fd8d4f52ba61e8b43bac043ae89ab29e173593593548e14a3981e239bd2

  • C:\Users\Admin\AppData\Roaming\32bit Patch.exe

    Filesize

    2.0MB

    MD5

    a26084634bab2ad1124e104447269bd8

    SHA1

    43379a654f142016d91ab1b7bb696e48b09fd65c

    SHA256

    5edaa30b874d91e663356e188705fd4579f7910cc610f4746858f0d96b47a599

    SHA512

    0361fb6a96862efaa7af2047e7f53f85da1b3f8886697fa63bf623d56d091f1c3b85e4d0e8ef6c8ee06cb5fb4022c4d2710ef3e7ce777d52adaf4c891aebab6c

  • C:\Users\Admin\AppData\Roaming\32bit Patch.exe

    Filesize

    1.5MB

    MD5

    014a6633585a89c8be4c80991ca8e4e0

    SHA1

    eaeed24ad805d1f2d6b7f10e3ab6ed0e67f5b581

    SHA256

    b4d25b0627f0d2fb88f51dd6383428daebe2fde862ca95547be8552634c13f85

    SHA512

    898277a68c4e77807d336f872be7a004a2e8aecfc7d49c2e6d9d69ec0a689d741cc60d7932bcd16f97a7fb9eecdde4b414c0fc2772a3de0f3564a2a1dd0bde17

  • C:\Users\Admin\AppData\Roaming\nan0.exe

    Filesize

    744KB

    MD5

    eb5dac7b7c59d99135d021760108ef5a

    SHA1

    a2a7f393eef680b8077895a8bfb7de09b7abb3eb

    SHA256

    6ec4ee2eadfc7e325e2b1e25f08bc5a7e4e6edc769521e3fa088ea9e68e854ba

    SHA512

    db8a5abcd5d5c4c318bac8d1bbcb4dd81b667168a4cbd2f94c5e191e62908ff70d2bf1a4c23c64d76a66dcb995c420fa8bf88397876fbd9658d155a2fb8d267a

  • C:\Users\Admin\AppData\Roaming\nvidia

    Filesize

    73KB

    MD5

    0f8e43ed64baa667770e749417e60d34

    SHA1

    81ba263ddd26fb643e7775e8890de04258a9b8df

    SHA256

    3530dde67c08938518222f1c3d52f8f5eb48629cdbf0567a96a5180d29af6682

    SHA512

    db41a26753a128ec93d759b8161ecfd5e59052788a245e11ac2efca9b75c5449b6b42e6b9b804cdef81c3c3f8e4719167189c2aa6d729abcee929f09087cb5a3

  • \Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.6MB

    MD5

    72af9d1a256297124ba2caf0e008a23e

    SHA1

    4343cb572feb2cae40a155b7126aafe3b66fb699

    SHA256

    95268103fa0a9a48a1686a4c98ed18a459bb3ac706cd774d87450ea9526fb88f

    SHA512

    47f6bc014f8274e426eb4a4c3702984afeef64cde4e02cdea893cd4dcf3bca716683a232c541bbf72f605f10dad9e56bb3c119afcb548c5711b3772cab2041de

  • \Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.6MB

    MD5

    69b7aba132952b1263ae190d934faac6

    SHA1

    7dac83d0945fba43b38259c94ee2f7db01cfec72

    SHA256

    4a0853bd11c4337fc44738389500bbf537d8b7edebf2754964f79699b4d00080

    SHA512

    0474b2788d1612f97bc6d4b9d60bd5255c77dd9c8c28688e4815c857409fdd892d5e052df2c6f3ad79a9f4e828d89db4377a27a90885b7d8fccf4c8e25cf430d

  • \Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.2MB

    MD5

    348141d30d5edc50ce53d629673ade71

    SHA1

    e36c163d926e1be72ace708124d91b149ea37ad0

    SHA256

    cd9d0415b3a4447fa945f970a28826ff3baff10e37cb8a92886e2a467ba6266b

    SHA512

    10f5bef0880964ac23a13cc3fc88456127a02b0760bef4686695719a4068ee7aebc9f1e73448a77c3e59c9f248d3cf6f97d0101c71a3ebaac8bc19ad09f68921

  • \Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.8MB

    MD5

    f8d9f739161722e291ecd8500ef83371

    SHA1

    cb96f5b3b71310fe4a5e0274ef05f9c3cb295151

    SHA256

    d6815861c1d05b306ebcd4eec408c69e895203fc0e1b429b585528f6d7e9241d

    SHA512

    d3bd589e83678d9cb9c4a493129971becadbc8f3522f18d7906ecdcfbb91a11666a1550e555f1e97d8e501a8beb7cf1f0aeaf4f5fb52417afa454e0f58e57462

  • \Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.3MB

    MD5

    e2ad596ddeaed06e434a0ccfe5f197ea

    SHA1

    bffe4cc4876dc90e7fdec2e9c3bcb1a31405a086

    SHA256

    678e6636b051170ae3a549c198b9347a9f2f29af9346ceef66d89d3ec6c9a7cf

    SHA512

    5aacb3311c5cabe46332b1096f15bb8bdf9b3911e43fe0350303bc3cb571d41788c04e9e5019641386e81b8003c919d754d34cca088eb9e09467408bd66a552c

  • \Users\Admin\AppData\Roaming\11.exe

    Filesize

    1.2MB

    MD5

    da7f3a087955941a62eab64c7c068b7e

    SHA1

    84f196582a8da8fb9517f289f230d742db9988e8

    SHA256

    9b50525b4453465532d46cba1de9f7024c491c4231daafa92bb2f7312801d4c5

    SHA512

    2454203e5ed67a6aea75de3dd452fd6a2188beef0193f143fcdc5a1300e204b517a3ce31c389efe20887260bb311145b58d0eeae552e51276d4b7c50142af4f3

  • memory/1724-1-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1724-0-0x0000000000980000-0x0000000001124000-memory.dmp

    Filesize

    7.6MB

  • memory/1724-37-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2020-68-0x00000000009D0000-0x00000000009DC000-memory.dmp

    Filesize

    48KB

  • memory/2020-72-0x0000000000AC0000-0x0000000000ACE000-memory.dmp

    Filesize

    56KB

  • memory/2020-81-0x0000000000A20000-0x0000000000A60000-memory.dmp

    Filesize

    256KB

  • memory/2020-79-0x0000000000C80000-0x0000000000C94000-memory.dmp

    Filesize

    80KB

  • memory/2020-78-0x0000000000E70000-0x0000000000E9E000-memory.dmp

    Filesize

    184KB

  • memory/2020-77-0x0000000000C60000-0x0000000000C6E000-memory.dmp

    Filesize

    56KB

  • memory/2020-76-0x0000000000C50000-0x0000000000C64000-memory.dmp

    Filesize

    80KB

  • memory/2020-75-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

    Filesize

    64KB

  • memory/2020-74-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

    Filesize

    80KB

  • memory/2020-55-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2020-53-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2020-51-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2020-73-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

    Filesize

    48KB

  • memory/2020-59-0x0000000000760000-0x000000000076A000-memory.dmp

    Filesize

    40KB

  • memory/2020-60-0x0000000000770000-0x000000000078E000-memory.dmp

    Filesize

    120KB

  • memory/2020-61-0x0000000000790000-0x000000000079A000-memory.dmp

    Filesize

    40KB

  • memory/2020-62-0x0000000000A20000-0x0000000000A60000-memory.dmp

    Filesize

    256KB

  • memory/2020-71-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

    Filesize

    72KB

  • memory/2020-70-0x0000000000A10000-0x0000000000A1E000-memory.dmp

    Filesize

    56KB

  • memory/2020-69-0x00000000009E0000-0x00000000009FA000-memory.dmp

    Filesize

    104KB

  • memory/2356-49-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2612-43-0x0000000074880000-0x0000000074F6E000-memory.dmp

    Filesize

    6.9MB

  • memory/2612-56-0x0000000074880000-0x0000000074F6E000-memory.dmp

    Filesize

    6.9MB

  • memory/2612-50-0x0000000000620000-0x0000000000623000-memory.dmp

    Filesize

    12KB

  • memory/2612-48-0x0000000000610000-0x0000000000613000-memory.dmp

    Filesize

    12KB

  • memory/2612-46-0x0000000004840000-0x0000000004880000-memory.dmp

    Filesize

    256KB

  • memory/2612-45-0x0000000004800000-0x0000000004840000-memory.dmp

    Filesize

    256KB

  • memory/2612-42-0x0000000000F50000-0x0000000001010000-memory.dmp

    Filesize

    768KB

  • memory/2776-32-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2776-63-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2776-31-0x0000000000950000-0x0000000000D86000-memory.dmp

    Filesize

    4.2MB