| File name: | CTF Loader.exe |
| Full analysis: | https://app.any.run/tasks/ef8d90f3-e05a-4030-8765-cf42adbf02ec |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | January 14, 2024, 06:59:05 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 213BC04533BD88FA7D7E4C347B494D39 |
| SHA1: | 8C0A668613D1CA3730FBB8B1A863ED22F2CDFCFB |
| SHA256: | CBD3C58617C3710AB3BBCCCDF6D3AB743149DBC983F6B93EB060ABD56CB55BD4 |
| SSDEEP: | 12288:nNFaXUoYRm6FmHY6X4oPeADJM01l4fZwutx3lF28zWL:nbGUoqZqY+zPeADiOl4RwuT1F5yL |
MALICIOUS
Drops the executable file immediately after the start
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Uses Task Scheduler to run other applications
- CTF Loader.exe (PID: 532)
NANOCORE has been detected (YARA)
- CTF Loader.exe (PID: 532)
NANOCORE has been detected (SURICATA)
- CTF Loader.exe (PID: 532)
Connects to the CnC server
- CTF Loader.exe (PID: 532)
SUSPICIOUS
Executable content was dropped or overwritten
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Reads the Internet Settings
- CTF Loader.exe (PID: 128)
Application launched itself
- CTF Loader.exe (PID: 128)
Connects to unusual port
- CTF Loader.exe (PID: 532)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 2488)
INFO
Reads the machine GUID from the registry
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Checks supported languages
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Creates files or folders in the user directory
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Process checks whether UAC notifications are on
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Create files in a temporary directory
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
- powershell.exe (PID: 1196)
Reads the computer name
- CTF Loader.exe (PID: 128)
- CTF Loader.exe (PID: 532)
Creates files in the program directory
- CTF Loader.exe (PID: 532)
Reads Environment values
- CTF Loader.exe (PID: 532)
Manual execution by a user
- cmd.exe (PID: 2488)
- taskmgr.exe (PID: 1900)
- WINWORD.EXE (PID: 452)
- taskmgr.exe (PID: 3128)
Reads security settings of Internet Explorer
- powershell.exe (PID: 1196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Nanocore
(PID) Process(532) CTF Loader.exe
KeyboardLoggingTrue
BuildTime2024-01-11 17:49:58.661672
Version1.2.2.0
Mutexc9aea832-64b3-4a54-a5dc-b3531f614eff
DefaultGroupDefault
PrimaryConnectionHost147.185.221.17
BackupConnectionHost147.185.221.17
ConnectionPort62984
RunOnStartupTrue
RequestElevationTrue
BypassUserAccountControlTrue
ClearZoneIdentifierTrue
ClearAccessControlTrue
SetCriticalProcessTrue
PreventSystemSleepTrue
ActivateAwayModeTrue
EnableDebugModeTrue
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2015:02:22 01:49:37+01:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 116736 |
| InitializedDataSize: | 449024 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1e792 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
56
Monitored processes
11
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 128 | "C:\Users\admin\AppData\Local\Temp\CTF Loader.exe" | C:\Users\admin\AppData\Local\Temp\CTF Loader.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 452 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\planttrading.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 532 | "C:\Users\admin\AppData\Local\Temp\CTF Loader.exe" | C:\Users\admin\AppData\Local\Temp\CTF Loader.exe | CTF Loader.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
Nanocore(PID) Process(532) CTF Loader.exe KeyboardLoggingTrue BuildTime2024-01-11 17:49:58.661672 Version1.2.2.0 Mutexc9aea832-64b3-4a54-a5dc-b3531f614eff DefaultGroupDefault PrimaryConnectionHost147.185.221.17 BackupConnectionHost147.185.221.17 ConnectionPort62984 RunOnStartupTrue RequestElevationTrue BypassUserAccountControlTrue ClearZoneIdentifierTrue ClearAccessControlTrue SetCriticalProcessTrue PreventSystemSleepTrue ActivateAwayModeTrue EnableDebugModeTrue RunDelay0 ConnectDelay4000 RestartDelay5000 TimeoutInterval5000 KeepAliveTimeout30000 MutexTimeout5000 LanTimeout2500 WanTimeout8000 BufferSize65535 MaxPacketSize10485760 GCThreshold10485760 UseCustomDnsServerTrue PrimaryDnsServer8.8.8.8 BackupDnsServer8.8.4.4 | |||||||||||||||
| 1196 | powershell | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 1316 | "schtasks.exe" /create /f /tn "TCP Monitor Task" /xml "C:\Users\admin\AppData\Local\Temp\tmpFABD.tmp" | C:\Windows\System32\schtasks.exe | — | CTF Loader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1588 | "schtasks.exe" /create /f /tn "TCP Monitor" /xml "C:\Users\admin\AppData\Local\Temp\tmpFA2F.tmp" | C:\Windows\System32\schtasks.exe | — | CTF Loader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1900 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2488 | "C:\Windows\system32\cmd.exe" | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2964 | powershell wininit | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 2972 | "C:\Windows\system32\wininit.exe" | C:\Windows\System32\wininit.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Start-Up Application Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
5 491
Read events
5 302
Write events
45
Delete events
144
Modification events
| (PID) Process: | (128) CTF Loader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (128) CTF Loader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (128) CTF Loader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (128) CTF Loader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (532) CTF Loader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | delete value | Name: | TCP Monitor |
Value: C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | |||
| (PID) Process: | (452) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (452) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: On | |||
| (PID) Process: | (452) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: On | |||
| (PID) Process: | (452) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: On | |||
| (PID) Process: | (452) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: On | |||
Executable files
3
Suspicious files
14
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRD807.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 128 | CTF Loader.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | executable | |
MD5:213BC04533BD88FA7D7E4C347B494D39 | SHA256:CBD3C58617C3710AB3BBCCCDF6D3AB743149DBC983F6B93EB060ABD56CB55BD4 | |||
| 532 | CTF Loader.exe | C:\Program Files\TCP Monitor\tcpmon.exe | executable | |
MD5:213BC04533BD88FA7D7E4C347B494D39 | SHA256:CBD3C58617C3710AB3BBCCCDF6D3AB743149DBC983F6B93EB060ABD56CB55BD4 | |||
| 532 | CTF Loader.exe | C:\Users\admin\AppData\Local\Temp\tmpFA2F.tmp | xml | |
MD5:C11B8AB5A526E3276A7B1B6F44FF1870 | SHA256:6084DE114BE6092687275F66D0FD56CF7EF49ACA15A80F2B49DB62C0D2B1F145 | |||
| 532 | CTF Loader.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\task.dat | text | |
MD5:F92631D0BCBA68E58D2F2A93C4D0C5A9 | SHA256:BF0A1ED5915F32EFCBB4729B7D7F7A66080D9B3E8BE16DA46581E9E68E0A0481 | |||
| 2964 | powershell.exe | C:\Users\admin\AppData\Local\Temp\xtl3tcht.bor.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 1196 | powershell.exe | C:\Users\admin\AppData\Local\Temp\3eraqmp0.jni.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 532 | CTF Loader.exe | C:\Users\admin\AppData\Local\Temp\tmpFABD.tmp | xml | |
MD5:E4118E3EC98934AA1D4235C87B44AA31 | SHA256:EFC475D73603DF6A26978D7BCAC27004830137E97FDD1656140B4A08C07470D9 | |||
| 1196 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tyczrljw.b4e.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 1196 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | binary | |
MD5:446DD1CF97EABA21CF14D03AEBC79F27 | SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
33
DNS requests
4
Threats
14
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
532 | CTF Loader.exe | 147.185.221.17:62984 | — | PLAYIT-GG | US | malicious |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |
532 | CTF Loader.exe | Malware Command and Control Activity Detected | ET MALWARE NanoCore RAT CnC 7 |