nanocore | cd041f14ff9c62fb4e6c474dbfb2dc8905b1680c8d58063d7e24381cef97a779

General

Target
STMPO3683HK.exe
Size 335KB
Sample200626-spewptce8e
SHA256 cd041f14ff9c62fb4e6c474dbfb2dc8905b1680c8d58063d7e24381cef97a779
MD5 bc819cddc10cd48bb77a200b3bb65605
SHA1 ba84b4fa488985e14d66ee5d7e88332e83e4c8ff
SHA512 d4c804e9149322516d69f8670692cadf5f1035f1ca332bab7287bb666adbcca855face7d22898b74d0eb14004f67e6ae989f11f50e319273d887f89e3f3ca08e
MD5 SHA1 SHA512

Score

10^/10

keylogger trojan stealer spyware nanocore evasion

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

darlingtondc.hopto.org:1905
185.165.153.17:1905

Mutex

f1e189ea-bf5f-4d37-b84c-3b194f4e6fe7

Attributes

activate_away_mode
true
backup_connection_host
185.165.153.17
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-14T23:32:54.424872236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1905
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f1e189ea-bf5f-4d37-b84c-3b194f4e6fe7
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
darlingtondc.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	MSBuild.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
752	schtasks.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 752	1588	STMPO3683HK.exe	24
PID 1588 wrote to memory of 752	1588	STMPO3683HK.exe	24
PID 1588 wrote to memory of 752	1588	STMPO3683HK.exe	24
PID 1588 wrote to memory of 752	1588	STMPO3683HK.exe	24
PID 1588 wrote to memory of 1028	1588	STMPO3683HK.exe	26
PID 1588 wrote to memory of 1028	1588	STMPO3683HK.exe	26
PID 1588 wrote to memory of 1028	1588	STMPO3683HK.exe	26
PID 1588 wrote to memory of 1028	1588	STMPO3683HK.exe	26
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27
PID 1588 wrote to memory of 1516	1588	STMPO3683HK.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	STMPO3683HK.exe
Token: SeDebugPrivilege	1516	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1588	STMPO3683HK.exe
1516	MSBuild.exe
1516	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1516	1588	STMPO3683HK.exe	27

C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe
"C:\Users\Admin\AppData\Local\Temp\STMPO3683HK.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1588
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iyeuvAtWIKNzzV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AC1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:752
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  PID:1028
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-2-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1516-4-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1516-5-0x0000000000400000-0x0000000000438000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads