Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/03/2024, 09:09
General
- Target a02efa13f302e39050ce8910bdf365eb5003e3e94a03c86026bbc863a0f5ebbb.exe
- Size 594KB
- Sample240309-k4v4ysfc71
- SHA256 a02efa13f302e39050ce8910bdf365eb5003e3e94a03c86026bbc863a0f5ebbb
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
maxlogs.webhop.me:1620
-
newnex.3utilities.com:1620
-
c8bd39f7-e8d9-4ee4-b178-2a6312d592d4
-
activate_away_mode
true
-
backup_connection_host
newnex.3utilities.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-01-14T08:58:05.762973136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1620
-
default_group
Bin
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c8bd39f7-e8d9-4ee4-b178-2a6312d592d4
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
maxlogs.webhop.me
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a02efa13f302e39050ce8910bdf365eb5003e3e94a03c86026bbc863a0f5ebbb.exe"C:\Users\Admin\AppData\Local\Temp\a02efa13f302e39050ce8910bdf365eb5003e3e94a03c86026bbc863a0f5ebbb.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qekSRmGikGSavl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qekSRmGikGSavl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7F1.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5xoaxwug.3uv.ps1
tmpD7F1.tmp
memory/492-74-0x0000000006CB0000-0x0000000006CC2000-memory.dmp
memory/492-29-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/492-97-0x0000000005500000-0x0000000005510000-memory.dmp
memory/492-96-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/492-49-0x0000000005500000-0x0000000005510000-memory.dmp
memory/492-81-0x0000000006D40000-0x0000000006D6E000-memory.dmp
memory/492-80-0x0000000006D30000-0x0000000006D3E000-memory.dmp
memory/492-79-0x0000000006D10000-0x0000000006D24000-memory.dmp
memory/492-78-0x0000000006CF0000-0x0000000006D00000-memory.dmp
memory/492-77-0x0000000006CE0000-0x0000000006CF4000-memory.dmp
memory/492-76-0x0000000006CD0000-0x0000000006CDE000-memory.dmp
memory/492-75-0x0000000006CC0000-0x0000000006CCC000-memory.dmp
memory/492-73-0x0000000006CA0000-0x0000000006CAE000-memory.dmp
memory/492-72-0x0000000006C70000-0x0000000006C8A000-memory.dmp
memory/492-71-0x0000000006C60000-0x0000000006C72000-memory.dmp
memory/492-48-0x00000000063C0000-0x00000000063CA000-memory.dmp
memory/492-82-0x0000000006D80000-0x0000000006D94000-memory.dmp
memory/492-47-0x0000000005AC0000-0x0000000005ADE000-memory.dmp
memory/492-24-0x0000000000400000-0x0000000000438000-memory.dmp
memory/492-46-0x0000000005A70000-0x0000000005A7A000-memory.dmp
memory/492-41-0x0000000005500000-0x0000000005510000-memory.dmp
memory/964-21-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/964-52-0x0000000006F40000-0x0000000006F72000-memory.dmp
memory/964-37-0x0000000006380000-0x00000000066D4000-memory.dmp
memory/964-90-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/964-86-0x0000000007FB0000-0x0000000007FB8000-memory.dmp
memory/964-26-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/964-42-0x0000000006960000-0x000000000697E000-memory.dmp
memory/964-43-0x0000000006BC0000-0x0000000006C0C000-memory.dmp
memory/964-25-0x0000000005980000-0x00000000059A2000-memory.dmp
memory/964-85-0x0000000007FD0000-0x0000000007FEA000-memory.dmp
memory/964-63-0x0000000006F20000-0x0000000006F3E000-memory.dmp
memory/964-28-0x0000000006310000-0x0000000006376000-memory.dmp
memory/964-51-0x000000007FBF0000-0x000000007FC00000-memory.dmp
memory/964-16-0x0000000003020000-0x0000000003056000-memory.dmp
memory/964-53-0x0000000075330000-0x000000007537C000-memory.dmp
memory/964-22-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/964-64-0x0000000007B40000-0x0000000007BE3000-memory.dmp
memory/964-65-0x00000000082C0000-0x000000000893A000-memory.dmp
memory/964-66-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/964-67-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/964-68-0x0000000007EF0000-0x0000000007F86000-memory.dmp
memory/964-69-0x0000000007E70000-0x0000000007E81000-memory.dmp
memory/964-20-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/964-19-0x0000000005B00000-0x0000000006128000-memory.dmp
memory/964-84-0x0000000007ED0000-0x0000000007EE4000-memory.dmp
memory/964-83-0x0000000007EC0000-0x0000000007ECE000-memory.dmp
memory/3656-23-0x0000000005520000-0x0000000005530000-memory.dmp
memory/3656-17-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/3656-11-0x0000000006730000-0x00000000067CC000-memory.dmp
memory/3656-10-0x0000000006880000-0x00000000068F2000-memory.dmp
memory/3656-9-0x0000000005520000-0x0000000005530000-memory.dmp
memory/3656-8-0x00000000056D0000-0x00000000056DA000-memory.dmp
memory/3656-7-0x00000000056C0000-0x00000000056C8000-memory.dmp
memory/3656-6-0x0000000005680000-0x0000000005698000-memory.dmp
memory/3656-0-0x0000000000910000-0x00000000009AA000-memory.dmp
memory/3656-2-0x0000000005520000-0x0000000005530000-memory.dmp
memory/3656-3-0x0000000005AE0000-0x0000000006084000-memory.dmp
memory/3656-1-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/3656-35-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/3656-5-0x0000000005670000-0x000000000567A000-memory.dmp
memory/3656-4-0x00000000055D0000-0x0000000005662000-memory.dmp