Analysis
- max time kernel
142s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
31/01/2024, 09:28
General
- Target 840ef8d2d1936ebf66e63f85c7dece42.exe
- Size 1.9MB
- Sample240131-lfnkmsahdn
- SHA256 6dad4f5325f635039e443e725ddaf3eb210952b0ebe81027dae9f9fb0a09e831
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
omaprilcode.duckdns.org:8090
-
f8dffc54-5ec5-4013-9de8-d8d853682f44
-
activate_away_mode
true
-
backup_connection_host
omaprilcode.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-01-26T15:04:24.913843336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8090
-
default_group
CODEDBASE
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f8dffc54-5ec5-4013-9de8-d8d853682f44
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
omaprilcode.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Windows security bypass 2 TTPs 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Windows security modification 2 TTPs 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe"C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe"1⤵
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\IfB44785yo4aR44dco3pdD14W\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\IfB44785yo4aR44dco3pdD14W\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe"C:\Users\Admin\AppData\Local\Temp\840ef8d2d1936ebf66e63f85c7dece42.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 16402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3472 -ip 34721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_v5vt2z5j.ex3.ps1
memory/1404-106-0x00000000079B0000-0x00000000079C1000-memory.dmp
memory/1404-98-0x0000000007820000-0x000000000782A000-memory.dmp
memory/1404-52-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/1404-26-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/1404-20-0x0000000005CC0000-0x0000000005D26000-memory.dmp
memory/1404-121-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/1404-69-0x000000006FC30000-0x000000006FC7C000-memory.dmp
memory/1404-55-0x000000007F190000-0x000000007F1A0000-memory.dmp
memory/1404-56-0x0000000006A50000-0x0000000006A82000-memory.dmp
memory/1404-14-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/1404-15-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/3224-97-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3224-123-0x0000000005CB0000-0x0000000005CC0000-memory.dmp
memory/3224-100-0x0000000005CB0000-0x0000000005CC0000-memory.dmp
memory/3224-122-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3224-105-0x0000000006750000-0x000000000675A000-memory.dmp
memory/3224-104-0x0000000005C90000-0x0000000005CAE000-memory.dmp
memory/3224-102-0x0000000005AB0000-0x0000000005ABA000-memory.dmp
memory/3224-93-0x0000000000400000-0x000000000043A000-memory.dmp
memory/3304-80-0x000000006FC30000-0x000000006FC7C000-memory.dmp
memory/3304-8-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3304-103-0x0000000007250000-0x00000000072E6000-memory.dmp
memory/3304-18-0x0000000004E00000-0x0000000004E22000-memory.dmp
memory/3304-54-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/3304-99-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/3304-96-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3304-12-0x0000000004FF0000-0x0000000005618000-memory.dmp
memory/3304-116-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3304-11-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/3304-92-0x0000000007620000-0x0000000007C9A000-memory.dmp
memory/3304-10-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/3304-7-0x0000000002390000-0x00000000023C6000-memory.dmp
memory/3304-50-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/3304-91-0x000000007FC00000-0x000000007FC10000-memory.dmp
memory/3472-81-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3472-5-0x0000000005270000-0x0000000005312000-memory.dmp
memory/3472-9-0x00000000087A0000-0x0000000008832000-memory.dmp
memory/3472-95-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/3472-13-0x0000000008750000-0x000000000875A000-memory.dmp
memory/3472-4-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/3472-3-0x0000000005310000-0x00000000053AC000-memory.dmp
memory/3472-1-0x0000000000720000-0x0000000000912000-memory.dmp
memory/3472-2-0x0000000005820000-0x0000000005DC4000-memory.dmp
memory/3472-120-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/3472-0-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/5108-17-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/5108-94-0x00000000073B0000-0x00000000073CA000-memory.dmp
memory/5108-79-0x00000000072B0000-0x0000000007353000-memory.dmp
memory/5108-107-0x00000000075E0000-0x00000000075EE000-memory.dmp
memory/5108-108-0x00000000075F0000-0x0000000007604000-memory.dmp
memory/5108-109-0x00000000076F0000-0x000000000770A000-memory.dmp
memory/5108-110-0x00000000076D0000-0x00000000076D8000-memory.dmp
memory/5108-68-0x0000000006640000-0x000000000665E000-memory.dmp
memory/5108-58-0x000000007EF80000-0x000000007EF90000-memory.dmp
memory/5108-117-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/5108-57-0x000000006FC30000-0x000000006FC7C000-memory.dmp
memory/5108-53-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/5108-51-0x00000000060D0000-0x000000000611C000-memory.dmp
memory/5108-49-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/5108-19-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/5108-16-0x0000000004BD0000-0x0000000004BE0000-memory.dmp