General

  • Target

    1419931da16fb9342724ab9beb64aaaabf127638c57f663d6f92781f7ebcff1e

  • Size

    349KB

  • Sample

    240929-xhnh7szcme

  • MD5

    9d415e19676f86adbc958e906e25d549

  • SHA1

    bab27ca151b9cfb86197a13f6e8dc557fd274039

  • SHA256

    1419931da16fb9342724ab9beb64aaaabf127638c57f663d6f92781f7ebcff1e

  • SHA512

    e66ff4d15068636aa9338bb15d3f7cf9131ef3acabae29a90516bbfe18752e0a1f2565f22a91df644a617e1102f9069c9d2004caad769e436792f439b4985c8c

  • SSDEEP

    6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpIM:FB1Q6rpr7MrswfLjGwW5xFdRyJpR

Malware Config

Extracted

Family

nanocore

Version

1.2.2.2

C2

bemery2.no-ip.biz:57628

127.0.0.1:57628

Mutex

997af15f-5576-4030-975c-eb3264fb6789

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2015-04-23T21:31:33.540664436Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    57628

  • default_group

    grace

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+08

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+09

  • mutex

    997af15f-5576-4030-975c-eb3264fb6789

  • mutex_timeout

    5000

  • prevent_system_sleep

    true

  • primary_connection_host

    bemery2.no-ip.biz

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.2

  • wan_timeout

    8000

Targets

    • Target

      1419931da16fb9342724ab9beb64aaaabf127638c57f663d6f92781f7ebcff1e

    • Size

      349KB

    • MD5

      9d415e19676f86adbc958e906e25d549

    • SHA1

      bab27ca151b9cfb86197a13f6e8dc557fd274039

    • SHA256

      1419931da16fb9342724ab9beb64aaaabf127638c57f663d6f92781f7ebcff1e

    • SHA512

      e66ff4d15068636aa9338bb15d3f7cf9131ef3acabae29a90516bbfe18752e0a1f2565f22a91df644a617e1102f9069c9d2004caad769e436792f439b4985c8c

    • SSDEEP

      6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpIM:FB1Q6rpr7MrswfLjGwW5xFdRyJpR

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.