Analysis

  • max time kernel
    118s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2024 09:42

General

  • Target

    POP.exe

  • Size

    660KB

  • MD5

    46d06b32a50fd0c1a1981695e6504aa5

  • SHA1

    562f1b0f554ab339d851e7c031059d20a1c88af6

  • SHA256

    3796fdf35ca6c4557746dc1de61e477fe9972bc44a2fb23503e302c27fab4335

  • SHA512

    c6ff00d37a3d8f8716df5a67d5f6e16bec0ec1a5ea4625138651ca8bc43ffda9e4ff77c158803d3399aa7543ec88dd37551215f60e159d226ac307cfd6e4cb44

  • SSDEEP

    12288:nYIPXjeFKYoJyZTH5Zx161j9QMRLPfVtc1qHNanyP8POCxU:nYIPGKYokbF01j9b1tcoMyP8POCy

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

amechi.duckdns.org:4190

Mutex

1e951a16-0899-4a49-9bed-fad9fc6657d1

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    amechi.duckdns.org

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2024-02-05T10:09:03.565293536Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4190

  • default_group

    clement

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    1e951a16-0899-4a49-9bed-fad9fc6657d1

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    amechi.duckdns.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\POP.exe
    "C:\Users\Admin\AppData\Local\Temp\POP.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\POP.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CXAoYUE.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CXAoYUE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50FD.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2928
    • C:\Users\Admin\AppData\Local\Temp\POP.exe
      "C:\Users\Admin\AppData\Local\Temp\POP.exe"
      2⤵
        PID:2416
      • C:\Users\Admin\AppData\Local\Temp\POP.exe
        "C:\Users\Admin\AppData\Local\Temp\POP.exe"
        2⤵
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 916
        2⤵
        • Program crash
        PID:1756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp50FD.tmp

      Filesize

      1KB

      MD5

      d12b1f1584ceaa70a5086466527516b2

      SHA1

      62b82de14630cc5b1689f44e142212c7185ffb11

      SHA256

      e1dd88b95707e0a96e67ebdee121ef437c37bba2682e339cffd0de3baddc1491

      SHA512

      a29c525572e02ea966695dee80d96b91874b773bcaa60a9226ed0164b906f16149c8311f19ec22d70621a03ba30130b19c4ef142c3b8e035343cc8078cda6bd9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      945480969aabfd5294c6ee025d52eb1f

      SHA1

      72cf6d77d513a21805fff6ffdcc5330236e35404

      SHA256

      c688b8563b4700691fc48cd2f35cf30e2fe8e1dc39c0169c97a4b317fd3dc830

      SHA512

      a7aa9130da5b085bfbe1c299e25370e71f653cccacdcc080da78c60deb413d4c233d1559651d64fcb5f07f51d64d0d2c4e519957878cfd705cd6648b6b733a5f

    • memory/2080-0-0x0000000000B40000-0x0000000000BEC000-memory.dmp

      Filesize

      688KB

    • memory/2080-1-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2080-2-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

      Filesize

      256KB

    • memory/2080-3-0x00000000005C0000-0x00000000005E0000-memory.dmp

      Filesize

      128KB

    • memory/2080-4-0x0000000000800000-0x0000000000814000-memory.dmp

      Filesize

      80KB

    • memory/2080-5-0x0000000004FC0000-0x000000000503A000-memory.dmp

      Filesize

      488KB

    • memory/2080-48-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

      Filesize

      256KB

    • memory/2080-47-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2412-37-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2412-58-0x0000000000B20000-0x0000000000B34000-memory.dmp

      Filesize

      80KB

    • memory/2412-21-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-24-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-26-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-28-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-63-0x00000000021B0000-0x00000000021C4000-memory.dmp

      Filesize

      80KB

    • memory/2412-62-0x0000000002200000-0x000000000222E000-memory.dmp

      Filesize

      184KB

    • memory/2412-61-0x0000000002150000-0x000000000215E000-memory.dmp

      Filesize

      56KB

    • memory/2412-60-0x0000000002140000-0x0000000002154000-memory.dmp

      Filesize

      80KB

    • memory/2412-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2412-59-0x0000000000B30000-0x0000000000B40000-memory.dmp

      Filesize

      64KB

    • memory/2412-20-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-54-0x00000000009B0000-0x00000000009BE000-memory.dmp

      Filesize

      56KB

    • memory/2412-39-0x00000000004B0000-0x00000000004BA000-memory.dmp

      Filesize

      40KB

    • memory/2412-40-0x0000000004980000-0x00000000049C0000-memory.dmp

      Filesize

      256KB

    • memory/2412-57-0x0000000000B10000-0x0000000000B1E000-memory.dmp

      Filesize

      56KB

    • memory/2412-42-0x00000000004C0000-0x00000000004DE000-memory.dmp

      Filesize

      120KB

    • memory/2412-43-0x00000000004E0000-0x00000000004EA000-memory.dmp

      Filesize

      40KB

    • memory/2412-56-0x0000000000AC0000-0x0000000000ACC000-memory.dmp

      Filesize

      48KB

    • memory/2412-55-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

      Filesize

      72KB

    • memory/2412-19-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-18-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2412-49-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2412-50-0x0000000004980000-0x00000000049C0000-memory.dmp

      Filesize

      256KB

    • memory/2412-52-0x00000000007B0000-0x00000000007C2000-memory.dmp

      Filesize

      72KB

    • memory/2412-53-0x0000000000A90000-0x0000000000AAA000-memory.dmp

      Filesize

      104KB

    • memory/2564-33-0x000000006E3C0000-0x000000006E96B000-memory.dmp

      Filesize

      5.7MB

    • memory/2564-45-0x000000006E3C0000-0x000000006E96B000-memory.dmp

      Filesize

      5.7MB

    • memory/2564-41-0x0000000000420000-0x0000000000460000-memory.dmp

      Filesize

      256KB

    • memory/2564-38-0x0000000000420000-0x0000000000460000-memory.dmp

      Filesize

      256KB

    • memory/2564-31-0x0000000000420000-0x0000000000460000-memory.dmp

      Filesize

      256KB

    • memory/2564-29-0x000000006E3C0000-0x000000006E96B000-memory.dmp

      Filesize

      5.7MB

    • memory/2568-44-0x000000006E3C0000-0x000000006E96B000-memory.dmp

      Filesize

      5.7MB

    • memory/2568-35-0x000000006E3C0000-0x000000006E96B000-memory.dmp

      Filesize

      5.7MB

    • memory/2568-32-0x00000000026C0000-0x0000000002700000-memory.dmp

      Filesize

      256KB

    • memory/2568-30-0x000000006E3C0000-0x000000006E96B000-memory.dmp

      Filesize

      5.7MB