nanocore | 03eacd008568d29ca8c5a4b9735f7fb6d2b2e5b7a1726f7ed316380e7b9f3e5c

General

Target
b901ca3106d5eb2ed5ff46849648a237.exe
Size 1.2MB
Sample200624-3d35d37bqa
SHA256 03eacd008568d29ca8c5a4b9735f7fb6d2b2e5b7a1726f7ed316380e7b9f3e5c
MD5 b901ca3106d5eb2ed5ff46849648a237
SHA1 329d2c4fc04c8d98c846102d39a2c12611b85b2a
SHA512 6f351f94229f2f9d5438723ffcc1c9c86ba1f03ce2131b91c0b37cf365488bd8d62a59886124d658866c8f29642c964d2a73ace238c8631ab66ba60eedf2ca23
MD5 SHA1 SHA512

Score

10^/10

persistence evasion trojan keylogger stealer spyware nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

79.134.225.23:1985

Mutex

7e45f769-694d-4682-8cfe-bdc0220401e9

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-02-24T11:23:34.464163736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1985
default_group
COVID
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7e45f769-694d-4682-8cfe-bdc0220401e9
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
79.134.225.23
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
828	b901ca3106d5eb2ed5ff46849648a237.exe
828	b901ca3106d5eb2ed5ff46849648a237.exe
828	b901ca3106d5eb2ed5ff46849648a237.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 828 set thread context of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
488	MSBuild.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WPA Service\wpasvc.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\WPA Service\wpasvc.exe	MSBuild.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fontdrvhost.url	b901ca3106d5eb2ed5ff46849648a237.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSBuild.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
828	b901ca3106d5eb2ed5ff46849648a237.exe
828	b901ca3106d5eb2ed5ff46849648a237.exe
828	b901ca3106d5eb2ed5ff46849648a237.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24
PID 828 wrote to memory of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24
PID 828 wrote to memory of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24
PID 828 wrote to memory of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24
PID 828 wrote to memory of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24
PID 828 wrote to memory of 488	828	b901ca3106d5eb2ed5ff46849648a237.exe	24

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
488	MSBuild.exe
488	MSBuild.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Service = "C:\\Program Files (x86)\\WPA Service\\wpasvc.exe"	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\b901ca3106d5eb2ed5ff46849648a237.exe
"C:\Users\Admin\AppData\Local\Temp\b901ca3106d5eb2ed5ff46849648a237.exe"
1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: GetForegroundWindowSpam
  - Drops file in Program Files directory
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Adds Run entry to start application
  PID:488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/488-2-0x0000000000400000-0x0000000000438000-memory.dmp