Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 05:42

General

  • Target

    768a83faefcdc81b408b09df7ed89395.exe

  • Size

    7.6MB

  • MD5

    768a83faefcdc81b408b09df7ed89395

  • SHA1

    5b7667574ef61d4b2003c819e87d6040a0b56f22

  • SHA256

    ebd4fcb03911f9f6d4ba31386e21881841c98591e78a539f976110b2ff7e8f05

  • SHA512

    abf219f8acc403fdef57d72f71c3523a610487ddd3bf543f413ce6b44fe2a76a3b016f63c48fd381e9b97fc336aaf19bc30ae2ac175becabf59f24fb399fc188

  • SSDEEP

    196608:YtPu+xXrI2bFvKQYs0TMDfzJppk2HDS2M0hdeJfVFUxri:6RrPFPYsJDdg2HGd00fzuri

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

sabifati34.duckdns.org:54984

kingspy.mywire.org:54984

Mutex

3c8bcba0-4059-4b34-be57-f36406e41f3b

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    kingspy.mywire.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-08-31T22:25:34.564478236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    ofis

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    3c8bcba0-4059-4b34-be57-f36406e41f3b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    sabifati34.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe
    "C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Users\Admin\AppData\Roaming\32bit Patch.exe
      "C:\Users\Admin\AppData\Roaming\32bit Patch.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2844
    • C:\Users\Admin\AppData\Roaming\11.exe
      "C:\Users\Admin\AppData\Roaming\11.exe"
      2⤵
      • Executes dropped EXE
      PID:728
    • C:\Users\Admin\AppData\Roaming\nan0.exe
      "C:\Users\Admin\AppData\Roaming\nan0.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1452
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1312

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\11.exe

      Filesize

      989KB

      MD5

      767e3bebe092ca47e5856ae2fae5c453

      SHA1

      1fcc083c041385bfa50476bf78fa72cebe025f6a

      SHA256

      ffd6bb6dc47d52ae9f02321905314b0d9828f997939d12493259eda1e0c73c46

      SHA512

      0453b8f8366853bab28c6bdd793b757f7b41cdbd2bb28f7e309020dffd5e97a545cfe23997217463be12b169973aa7936634aa9c17cb76f8f851675d88f85d93

    • C:\Users\Admin\AppData\Roaming\11.exe

      Filesize

      1.1MB

      MD5

      a73be1e0cf92fa060dd72a9298e248c7

      SHA1

      13647ffbbdd28e5016770233d61f7c6904794dff

      SHA256

      c1049504a0e29d2b35ecd83f747f4770551e29f70c4a5a4728eb9ce478bc1bdd

      SHA512

      f4667698081aef6a6629d19c28704a5b834924402c299bf0a3827e6d6982573494ec88327b6c6462e1b35bc27194f36975faef6063ec9f92f18d323d15508079

    • C:\Users\Admin\AppData\Roaming\11.exe

      Filesize

      1.0MB

      MD5

      e07418dc6d3680af28be6a647f8bd4dd

      SHA1

      bae1a2796bd212c4e30116cf89e84bbff37a0317

      SHA256

      51c464395767688f6d545c4ab894f892b16b53a736d789ca555cb2c75c301096

      SHA512

      3942178c4f3ac1de880c879206ddd2644c001829dbec482d56ccf85b3254e4442e06463a9edea46802adae09ea1976e0f47d9683cae61e95538cf0bf473c3e94

    • C:\Users\Admin\AppData\Roaming\32bit Patch.exe

      Filesize

      1.2MB

      MD5

      687ae36a5a6422c66e8c65a5f44a1f74

      SHA1

      43bf001c867fec70722e4e0db5378dab565e6456

      SHA256

      be9b2b3fb3730378110a9911e18af87b2969ee8400b13a078ba3a65312b87d03

      SHA512

      99ac05cde085cd9c624caecfc37ff4e71a36dfc827e5433a8c8287a02998427c2b65c62205f2aedf23470b0069b69e923d986895e14f29686190bb19d8d3c9c2

    • C:\Users\Admin\AppData\Roaming\32bit Patch.exe

      Filesize

      1.3MB

      MD5

      6f86cb7b2a458135e3ebf1157febe13d

      SHA1

      f5b16aef3346938d43f3cb87bb1dc0dc68dab87c

      SHA256

      78432ad49cf03023a5ac7068d29cef55c46319ce797a0e36d23de548df00a03d

      SHA512

      89c634779e1778a1e2d35841553f1307ddc8b1ea02f20822f92d5d9e92eda187ea2ada86bae51cddf2586f20ad05a52014008f1421846fccd986dfdaa4626d4f

    • C:\Users\Admin\AppData\Roaming\32bit Patch.exe

      Filesize

      1.9MB

      MD5

      566452be3534b31515d00acbead7cde3

      SHA1

      a349b2b9e8ad7cc5a003b1d190cdad54480ae1b0

      SHA256

      486d5e6344ff0416ada988efc71a99147560b1a27d75aa259a5aca40af3feb82

      SHA512

      805ccb2321b97fbf7764ce423dea58cfa0a5ff559743946a60ad723f615e557e7447fb534b883c8ca948dc86b3eb09d9fd9321ce31ad0176acb34e4fcf1f14a0

    • C:\Users\Admin\AppData\Roaming\nan0.exe

      Filesize

      744KB

      MD5

      eb5dac7b7c59d99135d021760108ef5a

      SHA1

      a2a7f393eef680b8077895a8bfb7de09b7abb3eb

      SHA256

      6ec4ee2eadfc7e325e2b1e25f08bc5a7e4e6edc769521e3fa088ea9e68e854ba

      SHA512

      db8a5abcd5d5c4c318bac8d1bbcb4dd81b667168a4cbd2f94c5e191e62908ff70d2bf1a4c23c64d76a66dcb995c420fa8bf88397876fbd9658d155a2fb8d267a

    • C:\Users\Admin\AppData\Roaming\nan0.exe

      Filesize

      619KB

      MD5

      2c50b3d8a2cfa624f33c5b87f212b9b6

      SHA1

      5fd68f0d0822bcfbd7e59f2a89b40a063da52d1b

      SHA256

      7b82f469a8d338a29b7ebe581bd0002d89023243614477d49cb0911df6a7b018

      SHA512

      a2990025b726556f7f2b8e9d96c1678d6abe2b7b8d6acf0851daa06b2d8f898fdd95d50bba4be060892cc371d518a6cc09660eabc740beab0c76460ee05267b3

    • memory/728-56-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

      Filesize

      10.8MB

    • memory/728-47-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

      Filesize

      10.8MB

    • memory/728-48-0x0000000000150000-0x0000000000586000-memory.dmp

      Filesize

      4.2MB

    • memory/1160-1-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

      Filesize

      10.8MB

    • memory/1160-49-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

      Filesize

      10.8MB

    • memory/1160-0-0x00000000006B0000-0x0000000000E54000-memory.dmp

      Filesize

      7.6MB

    • memory/1312-62-0x0000000005260000-0x0000000005804000-memory.dmp

      Filesize

      5.6MB

    • memory/1312-84-0x0000000006930000-0x0000000006940000-memory.dmp

      Filesize

      64KB

    • memory/1312-93-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/1312-92-0x0000000074780000-0x0000000074F30000-memory.dmp

      Filesize

      7.7MB

    • memory/1312-89-0x0000000006B80000-0x0000000006BE6000-memory.dmp

      Filesize

      408KB

    • memory/1312-88-0x00000000069C0000-0x00000000069D4000-memory.dmp

      Filesize

      80KB

    • memory/1312-60-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1312-87-0x0000000006990000-0x00000000069BE000-memory.dmp

      Filesize

      184KB

    • memory/1312-86-0x0000000006970000-0x000000000697E000-memory.dmp

      Filesize

      56KB

    • memory/1312-85-0x0000000006950000-0x0000000006964000-memory.dmp

      Filesize

      80KB

    • memory/1312-64-0x0000000074780000-0x0000000074F30000-memory.dmp

      Filesize

      7.7MB

    • memory/1312-65-0x0000000004E90000-0x0000000004F2C000-memory.dmp

      Filesize

      624KB

    • memory/1312-66-0x0000000004E20000-0x0000000004E2A000-memory.dmp

      Filesize

      40KB

    • memory/1312-69-0x0000000005230000-0x000000000523A000-memory.dmp

      Filesize

      40KB

    • memory/1312-70-0x0000000005240000-0x000000000525E000-memory.dmp

      Filesize

      120KB

    • memory/1312-83-0x0000000006920000-0x0000000006934000-memory.dmp

      Filesize

      80KB

    • memory/1312-73-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/1312-71-0x0000000005D40000-0x0000000005D4A000-memory.dmp

      Filesize

      40KB

    • memory/1312-77-0x00000000068A0000-0x00000000068AC000-memory.dmp

      Filesize

      48KB

    • memory/1312-78-0x00000000068B0000-0x00000000068CA000-memory.dmp

      Filesize

      104KB

    • memory/1312-79-0x00000000068E0000-0x00000000068EE000-memory.dmp

      Filesize

      56KB

    • memory/1312-80-0x00000000068F0000-0x0000000006902000-memory.dmp

      Filesize

      72KB

    • memory/1312-81-0x0000000006900000-0x000000000690E000-memory.dmp

      Filesize

      56KB

    • memory/1312-82-0x0000000006910000-0x000000000691C000-memory.dmp

      Filesize

      48KB

    • memory/1928-51-0x0000000005000000-0x0000000005092000-memory.dmp

      Filesize

      584KB

    • memory/1928-63-0x0000000074780000-0x0000000074F30000-memory.dmp

      Filesize

      7.7MB

    • memory/1928-50-0x0000000000700000-0x00000000007C0000-memory.dmp

      Filesize

      768KB

    • memory/1928-59-0x00000000052A0000-0x00000000052A3000-memory.dmp

      Filesize

      12KB

    • memory/1928-58-0x0000000005290000-0x0000000005293000-memory.dmp

      Filesize

      12KB

    • memory/1928-52-0x0000000074780000-0x0000000074F30000-memory.dmp

      Filesize

      7.7MB

    • memory/1928-55-0x0000000005540000-0x0000000005580000-memory.dmp

      Filesize

      256KB

    • memory/1928-54-0x0000000005160000-0x0000000005170000-memory.dmp

      Filesize

      64KB

    • memory/2844-72-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB