nanocore | 7528449cf7a3a8d1b8d56a5207cbcff5c2afe95aa6f4258acfa858a28bd370f5

General

Target
WAKP8SGlObhxWF1.exe
Size 315KB
Sample200624-28ds8tr49e
SHA256 7528449cf7a3a8d1b8d56a5207cbcff5c2afe95aa6f4258acfa858a28bd370f5
MD5 61190a1e66bdd33a70c65263dd04f1db
SHA1 6023cf38880d120733f7d04e4ce77fe26ea87cfb
SHA512 5b30674bbb1c7cc56770d8fdd0ec7618ee66f1b15679a5f3921f4b782f7f06cc34978df3d14c48507340bdf5b555d2b9079e340095a69805b17e0f95ad560c48
MD5 SHA1 SHA512

Score

10^/10

keylogger trojan stealer spyware nanocore persistence evasion

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

91.193.75.58:1985

Mutex

596c2bb9-90b7-4362-af9a-082627ebed15

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-30T21:40:30.911959536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
1985
default_group
official
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
596c2bb9-90b7-4362-af9a-082627ebed15
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
91.193.75.58
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
648	RegSvcs.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe
File created	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe"	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 3828	344	WAKP8SGlObhxWF1.exe	73
PID 344 wrote to memory of 3828	344	WAKP8SGlObhxWF1.exe	73
PID 344 wrote to memory of 3828	344	WAKP8SGlObhxWF1.exe	73
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75
PID 344 wrote to memory of 648	344	WAKP8SGlObhxWF1.exe	75

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 344 set thread context of 648	344	WAKP8SGlObhxWF1.exe	75

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	WAKP8SGlObhxWF1.exe
Token: SeDebugPrivilege	648	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
344	WAKP8SGlObhxWF1.exe
648	RegSvcs.exe
648	RegSvcs.exe
648	RegSvcs.exe
648	RegSvcs.exe
648	RegSvcs.exe
648	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3828	schtasks.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\WAKP8SGlObhxWF1.exe
"C:\Users\Admin\AppData\Local\Temp\WAKP8SGlObhxWF1.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:344
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UfuIdatdv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp10DE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3828
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Drops file in Program Files directory
  - Adds Run entry to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Checks whether UAC is enabled
  PID:648