Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-12-2024 06:47
Errors
General
-
Target
Loader.exe
-
Size
202KB
-
MD5
7280028431d7027ec91a5d0e66f10454
-
SHA1
111c1c8b84a9e594aeddf940887c6ef25ab4ad4d
-
SHA256
2a7e2209067453a8c3a9c0ca48410bba692f0cda04b8b262f71774c5be6abcea
-
SHA512
d0910785383246f220bbbe1162c877729deaf4c0cf0fc52ba03cab074f611953876361f680358e3306cd6dd6ddf28ff6e83ec56220e03a6ff2d9cd0601b3e1d4
-
SSDEEP
6144:gLV6Bta6dtJmakIM5EG1amlMCGx5PkRKMV9BP:gLV6BtpmkvG17lMCGzPK
Malware Config
Extracted
nanocore
1.2.2.0
international-linked.gl.at.ply.gg:30954
127.0.0.1:30954
32765331-9ec8-4982-a18f-8e2df3122afa
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
- backup_dns_server
-
buffer_size
65535
-
build_time
2024-09-26T08:23:36.948900636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
30954
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
32765331-9ec8-4982-a18f-8e2df3122afa
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
international-linked.gl.at.ply.gg
- primary_dns_server
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2d4 0x46c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3880855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD57280028431d7027ec91a5d0e66f10454
SHA1111c1c8b84a9e594aeddf940887c6ef25ab4ad4d
SHA2562a7e2209067453a8c3a9c0ca48410bba692f0cda04b8b262f71774c5be6abcea
SHA512d0910785383246f220bbbe1162c877729deaf4c0cf0fc52ba03cab074f611953876361f680358e3306cd6dd6ddf28ff6e83ec56220e03a6ff2d9cd0601b3e1d4
-
Filesize
768B
MD5c46ede29279a34c143c313c700b12dc0
SHA114601e4d19da467e3d926935ff952c2b2df2556d
SHA2567e361e0d9f67924114b540af44cf4b5a51ac03aa9331c8db6a1f4de14e8717bb
SHA512ae96987e6146f5c6cb2e4c626dd4eadd4c0f8ed64e0cc70fb98b40787f2467fcd21945ba3ef14af6183b06eac2fea2fa5996f915d4cf7e8284158a39870769f8
-
Filesize
232B
MD59e7d0351e4df94a9b0badceb6a9db963
SHA176c6a69b1c31cea2014d1fd1e222a3dd1e433005
SHA256aafc7b40c5fe680a2bb549c3b90aabaac63163f74fffc0b00277c6bbff88b757
SHA51293ccf7e046a3c403ecf8bc4f1a8850ba0180fe18926c98b297c5214eb77bc212c8fbcc58412d0307840cf2715b63be68bacda95aa98e82835c5c53f17ef38511
-
Filesize
8B
MD591b828030927e7cb38c7f19162c08879
SHA1d843ffa1377ac8ff462686b0c1bba8ed823dc846
SHA25685f9abb08c113179eeeb31533baed0d5a0d9aa14a0fbce3d4c64efcba1d7f9dc
SHA512533b7a2810af7750f15d58c7acd2ab5d87fc87731e2345cd7820fa862107e6fc02edaac07ef2adc1f62f23e84b05981735271db7e7e5069904266bfd59379ec1
-
Filesize
40B
MD5ae0f5e6ce7122af264ec533c6b15a27b
SHA11265a495c42eed76cc043d50c60c23297e76cce1
SHA25673b0b92179c61c26589b47e9732ce418b07edee3860ee5a2a5fb06f3b8aa9b26
SHA512dd44c2d24d4e3a0f0b988ad3d04683b5cb128298043134649bbe33b2512ce0c9b1a8e7d893b9f66fbbcdd901e2b0646c4533fb6c0c8c4afcb95a0efb95d446f8
-
Filesize
416KB
MD5653dddcb6c89f6ec51f3ddc0053c5914
SHA14cf7e7d42495ce01c261e4c5c4b8bf6cd76ccee5
SHA25683b9cae66800c768887fb270728f6806cbebdead9946fa730f01723847f17ff9
SHA51227a467f2364c21cd1c6c34ef1ca5ffb09b4c3180fc9c025e293374eb807e4382108617bb4b97f8ebbc27581cd6e5988bb5e21276b3cb829c1c0e49a6fc9463a0
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB