General

  • Target

    3a39b16020e7e439c110c43bc0e117ab059268b1b999f1f0af1b625b1f553eda

  • Size

    282KB

  • Sample

    241011-x3274azalc

  • MD5

    8e9cdc4e61e16fef150dac299e2585ad

  • SHA1

    cdd3dff78562abc8937b2d8cb614ba2b716aaad4

  • SHA256

    3a39b16020e7e439c110c43bc0e117ab059268b1b999f1f0af1b625b1f553eda

  • SHA512

    4161a1868488b88942cd9fe0ea65145deedaedf4ae3654c9cc77fa0afea2b4b3c005be7fdf7dad31a635f40108ae46d7cee571cdf0d0562a0e1deca408a254b6

  • SSDEEP

    6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfM9:boSeGUA5YZazpXUmZhZ6Sh

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

sysupdate24.ddns.net:45400

Mutex

ae82ab7f-db07-49ee-9d2b-76075d76f37f

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2020-04-24T17:41:53.492468936Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    45400

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    ae82ab7f-db07-49ee-9d2b-76075d76f37f

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    sysupdate24.ddns.net

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      3a39b16020e7e439c110c43bc0e117ab059268b1b999f1f0af1b625b1f553eda

    • Size

      282KB

    • MD5

      8e9cdc4e61e16fef150dac299e2585ad

    • SHA1

      cdd3dff78562abc8937b2d8cb614ba2b716aaad4

    • SHA256

      3a39b16020e7e439c110c43bc0e117ab059268b1b999f1f0af1b625b1f553eda

    • SHA512

      4161a1868488b88942cd9fe0ea65145deedaedf4ae3654c9cc77fa0afea2b4b3c005be7fdf7dad31a635f40108ae46d7cee571cdf0d0562a0e1deca408a254b6

    • SSDEEP

      6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfM9:boSeGUA5YZazpXUmZhZ6Sh

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.