nanocore | 7528449cf7a3a8d1b8d56a5207cbcff5c2afe95aa6f4258acfa858a28bd370f5

General

Target
WAKP8SGlObhxWF1.exe
Size 315KB
Sample200624-28ds8tr49e
SHA256 7528449cf7a3a8d1b8d56a5207cbcff5c2afe95aa6f4258acfa858a28bd370f5
MD5 61190a1e66bdd33a70c65263dd04f1db
SHA1 6023cf38880d120733f7d04e4ce77fe26ea87cfb
SHA512 5b30674bbb1c7cc56770d8fdd0ec7618ee66f1b15679a5f3921f4b782f7f06cc34978df3d14c48507340bdf5b555d2b9079e340095a69805b17e0f95ad560c48
MD5 SHA1 SHA512

Score

10^/10

persistence evasion trojan keylogger stealer spyware nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

91.193.75.58:1985

Mutex

596c2bb9-90b7-4362-af9a-082627ebed15

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-30T21:40:30.911959536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
1985
default_group
official
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
596c2bb9-90b7-4362-af9a-082627ebed15
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
91.193.75.58
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Service = "C:\\Program Files (x86)\\WPA Service\\wpasvc.exe"	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WPA Service\wpasvc.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\WPA Service\wpasvc.exe	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	WAKP8SGlObhxWF1.exe
Token: SeDebugPrivilege	1752	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1400	WAKP8SGlObhxWF1.exe
1400	WAKP8SGlObhxWF1.exe
1752	RegSvcs.exe
1752	RegSvcs.exe
1752	RegSvcs.exe
1752	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1752	1400	WAKP8SGlObhxWF1.exe	29

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1796	schtasks.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1796	1400	WAKP8SGlObhxWF1.exe	26
PID 1400 wrote to memory of 1796	1400	WAKP8SGlObhxWF1.exe	26
PID 1400 wrote to memory of 1796	1400	WAKP8SGlObhxWF1.exe	26
PID 1400 wrote to memory of 1796	1400	WAKP8SGlObhxWF1.exe	26
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1832	1400	WAKP8SGlObhxWF1.exe	28
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29
PID 1400 wrote to memory of 1752	1400	WAKP8SGlObhxWF1.exe	29

C:\Users\Admin\AppData\Local\Temp\WAKP8SGlObhxWF1.exe
"C:\Users\Admin\AppData\Local\Temp\WAKP8SGlObhxWF1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UfuIdatdv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1796
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:1832
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run entry to start application
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Checks whether UAC is enabled
  PID:1752