Analysis
- max time kernel
155s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 14:54
General
- Target 8f6fdc29008526290efbec29ac4ff319.exe
- Size 1.2MB
- Sample240204-r93vbacea6
- SHA256 b702770f7ead5e8640aaf61311dc4fd7ec133b52151cc7ccefad57312da5e77e
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
tony3311.ddns.net:10108
-
94803e62-45dd-47d9-9960-20dd767ecae3
-
activate_away_mode
true
-
backup_connection_host
tony3311.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-01-28T20:03:37.355466936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
10108
-
default_group
APILA 2021
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
94803e62-45dd-47d9-9960-20dd767ecae3
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tony3311.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6fdc29008526290efbec29ac4ff319.exe"C:\Users\Admin\AppData\Local\Temp\8f6fdc29008526290efbec29ac4ff319.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8f6fdc29008526290efbec29ac4ff319.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lgXWtErtxyegAQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lgXWtErtxyegAQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp713E.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lgXWtErtxyegAQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\8f6fdc29008526290efbec29ac4ff319.exe"C:\Users\Admin\AppData\Local\Temp\8f6fdc29008526290efbec29ac4ff319.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
8f6fdc29008526290efbec29ac4ff319.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ecaoo2fo.u15.ps1
tmp713E.tmp
memory/2148-115-0x0000000007E70000-0x0000000007E7E000-memory.dmp
memory/2148-27-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/2148-76-0x00000000078E0000-0x0000000007912000-memory.dmp
memory/2148-100-0x0000000007920000-0x00000000079C3000-memory.dmp
memory/2148-75-0x000000007F050000-0x000000007F060000-memory.dmp
memory/2148-74-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2148-114-0x0000000007E40000-0x0000000007E51000-memory.dmp
memory/2148-16-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2148-17-0x0000000005340000-0x0000000005376000-memory.dmp
memory/2148-18-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/2148-19-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/2148-20-0x0000000005B10000-0x0000000006138000-memory.dmp
memory/2148-72-0x00000000054D0000-0x00000000054E0000-memory.dmp
memory/2148-71-0x0000000006E80000-0x0000000006ECC000-memory.dmp
memory/2148-127-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2148-68-0x0000000006920000-0x000000000693E000-memory.dmp
memory/2148-80-0x0000000070DF0000-0x0000000070E3C000-memory.dmp
memory/2148-116-0x0000000007E80000-0x0000000007E94000-memory.dmp
memory/2148-118-0x0000000007F60000-0x0000000007F68000-memory.dmp
memory/2196-3-0x00000000054B0000-0x0000000005542000-memory.dmp
memory/2196-7-0x00000000058F0000-0x0000000005902000-memory.dmp
memory/2196-1-0x0000000000980000-0x0000000000ABA000-memory.dmp
memory/2196-2-0x0000000005A60000-0x0000000006004000-memory.dmp
memory/2196-8-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2196-51-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2196-11-0x00000000010D0000-0x000000000110A000-memory.dmp
memory/2196-0-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2196-9-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/2196-4-0x00000000055F0000-0x000000000568C000-memory.dmp
memory/2196-6-0x0000000005550000-0x000000000555A000-memory.dmp
memory/2196-5-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/2196-10-0x0000000006EC0000-0x0000000006F6A000-memory.dmp
memory/2584-67-0x0000000005A40000-0x0000000005A4A000-memory.dmp
memory/2584-129-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2584-130-0x0000000005710000-0x0000000005720000-memory.dmp
memory/2584-70-0x0000000006500000-0x000000000650A000-memory.dmp
memory/2584-69-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
memory/2584-55-0x0000000005710000-0x0000000005720000-memory.dmp
memory/2584-50-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2584-38-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4504-54-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4504-53-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4504-128-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4504-117-0x0000000007FB0000-0x0000000007FCA000-memory.dmp
memory/4504-99-0x0000000070DF0000-0x0000000070E3C000-memory.dmp
memory/4504-52-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4716-111-0x0000000007320000-0x000000000733A000-memory.dmp
memory/4716-49-0x0000000005A00000-0x0000000005D54000-memory.dmp
memory/4716-113-0x00000000075A0000-0x0000000007636000-memory.dmp
memory/4716-73-0x0000000004B40000-0x0000000004B50000-memory.dmp
memory/4716-78-0x000000007EFB0000-0x000000007EFC0000-memory.dmp
memory/4716-110-0x0000000007970000-0x0000000007FEA000-memory.dmp
memory/4716-77-0x0000000070DF0000-0x0000000070E3C000-memory.dmp
memory/4716-112-0x0000000007390000-0x000000000739A000-memory.dmp
memory/4716-26-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/4716-25-0x0000000005000000-0x0000000005022000-memory.dmp
memory/4716-22-0x0000000004B40000-0x0000000004B50000-memory.dmp
memory/4716-126-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4716-89-0x00000000065B0000-0x00000000065CE000-memory.dmp
memory/4716-23-0x0000000004B40000-0x0000000004B50000-memory.dmp
memory/4716-21-0x00000000747A0000-0x0000000074F50000-memory.dmp