General

  • Target

    1c30d6ffde78e18276661f7d09ec50276a7c551db942c71542a56d77bba24ea4N.exe

  • Size

    1.0MB

  • Sample

    250201-t3alaszrcs

  • MD5

    1b5fc11f62c4d568d05369aa7806cbe0

  • SHA1

    13e9c054cfca5834dd569d9d90f9b30c1d388362

  • SHA256

    1c30d6ffde78e18276661f7d09ec50276a7c551db942c71542a56d77bba24ea4

  • SHA512

    ddf8727c914c08bacc4ad65fc69e6611b635e1bd80a938354b0c10c10c54286c17666bc7cc71e654b2e3c5816eee99c6587a266f814216fa49bbc3e851cab833

  • SSDEEP

    24576:Jur9gkEPGcHHXYDYDa6naGhywpCjq7jUv7cF6kZ6YriDfZ49p50/G:Ur9gNGKXYD+naGEsBXUv66k8o4yp5wG

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

testwork.kozow.com:8906

Mutex

bd6fc7b5-d48b-4e23-98f7-784bd3ef305c

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    testwork.kozow.com

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2019-02-16T16:47:25.218235636Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    8906

  • default_group

    star

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    bd6fc7b5-d48b-4e23-98f7-784bd3ef305c

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    testwork.kozow.com

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      1c30d6ffde78e18276661f7d09ec50276a7c551db942c71542a56d77bba24ea4N.exe

    • Size

      1.0MB

    • MD5

      1b5fc11f62c4d568d05369aa7806cbe0

    • SHA1

      13e9c054cfca5834dd569d9d90f9b30c1d388362

    • SHA256

      1c30d6ffde78e18276661f7d09ec50276a7c551db942c71542a56d77bba24ea4

    • SHA512

      ddf8727c914c08bacc4ad65fc69e6611b635e1bd80a938354b0c10c10c54286c17666bc7cc71e654b2e3c5816eee99c6587a266f814216fa49bbc3e851cab833

    • SSDEEP

      24576:Jur9gkEPGcHHXYDYDa6naGhywpCjq7jUv7cF6kZ6YriDfZ49p50/G:Ur9gNGKXYD+naGEsBXUv66k8o4yp5wG

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Nanocore family

    • Drops startup file

    • Checks whether UAC is enabled

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.