Analysis

  • max time kernel
    117s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2024 09:41

General

  • Target

    POP.exe

  • Size

    660KB

  • MD5

    46d06b32a50fd0c1a1981695e6504aa5

  • SHA1

    562f1b0f554ab339d851e7c031059d20a1c88af6

  • SHA256

    3796fdf35ca6c4557746dc1de61e477fe9972bc44a2fb23503e302c27fab4335

  • SHA512

    c6ff00d37a3d8f8716df5a67d5f6e16bec0ec1a5ea4625138651ca8bc43ffda9e4ff77c158803d3399aa7543ec88dd37551215f60e159d226ac307cfd6e4cb44

  • SSDEEP

    12288:nYIPXjeFKYoJyZTH5Zx161j9QMRLPfVtc1qHNanyP8POCxU:nYIPGKYokbF01j9b1tcoMyP8POCy

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

amechi.duckdns.org:4190

Mutex

1e951a16-0899-4a49-9bed-fad9fc6657d1

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    amechi.duckdns.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2024-02-05T10:09:03.565293536Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4190

  • default_group

    clement

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    1e951a16-0899-4a49-9bed-fad9fc6657d1

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    amechi.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\POP.exe
    "C:\Users\Admin\AppData\Local\Temp\POP.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\POP.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2540
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CXAoYUE.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2392
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CXAoYUE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C4A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3044
    • C:\Users\Admin\AppData\Local\Temp\POP.exe
      "C:\Users\Admin\AppData\Local\Temp\POP.exe"
      2⤵
        PID:2404
      • C:\Users\Admin\AppData\Local\Temp\POP.exe
        "C:\Users\Admin\AppData\Local\Temp\POP.exe"
        2⤵
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1016
        2⤵
        • Program crash
        PID:2800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp6C4A.tmp

      Filesize

      1KB

      MD5

      6d0ab94f6c663e059ad168638f8e09e5

      SHA1

      7de762472144dabcdb85d166feb5ac53bcf22bc1

      SHA256

      3c9eedf6d3874ecd7fe0bfb039cf3153ad130528b7ae6b487e42686ca92f1158

      SHA512

      e179e3a09f200f4a82702b60ca4029ab78747d2b681194605bd2939e1c064f13eb0bfbf295fdbc0d8dc8aa5d76d626e2fa63a7acfd7158975d1f11b762e2ef9a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NAQQNZ0BRQJ95FF7RXTP.temp

      Filesize

      7KB

      MD5

      61d1bf8c5656905f60783b0bf6816dec

      SHA1

      a177bf64f3d6e078428ffa7bb7d7314531af62f7

      SHA256

      48742b0c9d56b2ad68aac4abb697c91b2a3ce820300cd63699acaa0e312096e7

      SHA512

      42b2fc0500d8e1437d33b5add920ce7760b1f4ff7822c996879f631dd50951e7fd4c26e9acd212eeea3357c1fb627fcd85cda75914591b7f274a4085215190eb

    • memory/2040-0-0x0000000000920000-0x00000000009CC000-memory.dmp

      Filesize

      688KB

    • memory/2040-45-0x0000000001FB0000-0x0000000001FF0000-memory.dmp

      Filesize

      256KB

    • memory/2040-4-0x0000000000610000-0x0000000000624000-memory.dmp

      Filesize

      80KB

    • memory/2040-5-0x000000000A1D0000-0x000000000A24A000-memory.dmp

      Filesize

      488KB

    • memory/2040-2-0x0000000001FB0000-0x0000000001FF0000-memory.dmp

      Filesize

      256KB

    • memory/2040-1-0x00000000743E0000-0x0000000074ACE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-43-0x00000000743E0000-0x0000000074ACE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-3-0x0000000000550000-0x0000000000570000-memory.dmp

      Filesize

      128KB

    • memory/2392-20-0x000000006DEB0000-0x000000006E45B000-memory.dmp

      Filesize

      5.7MB

    • memory/2392-51-0x000000006DEB0000-0x000000006E45B000-memory.dmp

      Filesize

      5.7MB

    • memory/2392-28-0x000000006DEB0000-0x000000006E45B000-memory.dmp

      Filesize

      5.7MB

    • memory/2392-26-0x0000000002A30000-0x0000000002A70000-memory.dmp

      Filesize

      256KB

    • memory/2392-34-0x0000000002A30000-0x0000000002A70000-memory.dmp

      Filesize

      256KB

    • memory/2392-30-0x0000000002A30000-0x0000000002A70000-memory.dmp

      Filesize

      256KB

    • memory/2448-40-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-50-0x0000000000460000-0x000000000047E000-memory.dmp

      Filesize

      120KB

    • memory/2448-69-0x0000000004810000-0x0000000004850000-memory.dmp

      Filesize

      256KB

    • memory/2448-25-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2448-60-0x0000000000910000-0x0000000000922000-memory.dmp

      Filesize

      72KB

    • memory/2448-61-0x0000000002090000-0x000000000209C000-memory.dmp

      Filesize

      48KB

    • memory/2448-37-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-21-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-42-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-62-0x00000000020E0000-0x00000000020EE000-memory.dmp

      Filesize

      56KB

    • memory/2448-44-0x00000000743E0000-0x0000000074ACE000-memory.dmp

      Filesize

      6.9MB

    • memory/2448-63-0x00000000020F0000-0x0000000002104000-memory.dmp

      Filesize

      80KB

    • memory/2448-49-0x0000000000450000-0x000000000045A000-memory.dmp

      Filesize

      40KB

    • memory/2448-46-0x0000000004810000-0x0000000004850000-memory.dmp

      Filesize

      256KB

    • memory/2448-65-0x0000000002210000-0x0000000002224000-memory.dmp

      Filesize

      80KB

    • memory/2448-18-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-29-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2448-53-0x0000000000490000-0x000000000049A000-memory.dmp

      Filesize

      40KB

    • memory/2448-55-0x00000000743E0000-0x0000000074ACE000-memory.dmp

      Filesize

      6.9MB

    • memory/2448-57-0x0000000000710000-0x0000000000722000-memory.dmp

      Filesize

      72KB

    • memory/2448-58-0x0000000000720000-0x000000000073A000-memory.dmp

      Filesize

      104KB

    • memory/2448-59-0x0000000000900000-0x000000000090E000-memory.dmp

      Filesize

      56KB

    • memory/2448-64-0x0000000002200000-0x0000000002210000-memory.dmp

      Filesize

      64KB

    • memory/2448-67-0x0000000002310000-0x000000000233E000-memory.dmp

      Filesize

      184KB

    • memory/2448-68-0x00000000022C0000-0x00000000022D4000-memory.dmp

      Filesize

      80KB

    • memory/2448-66-0x0000000002220000-0x000000000222E000-memory.dmp

      Filesize

      56KB

    • memory/2540-52-0x000000006DEB0000-0x000000006E45B000-memory.dmp

      Filesize

      5.7MB

    • memory/2540-24-0x00000000029C0000-0x0000000002A00000-memory.dmp

      Filesize

      256KB

    • memory/2540-22-0x000000006DEB0000-0x000000006E45B000-memory.dmp

      Filesize

      5.7MB

    • memory/2540-38-0x00000000029C0000-0x0000000002A00000-memory.dmp

      Filesize

      256KB

    • memory/2540-36-0x000000006DEB0000-0x000000006E45B000-memory.dmp

      Filesize

      5.7MB

    • memory/2540-32-0x00000000029C0000-0x0000000002A00000-memory.dmp

      Filesize

      256KB