nanocore | 2f003ca84db5f82fcf36040f7d97baae64e0582e830c8c1cea65c32c3d5b21d5

General

Target

Invoice.exe
Size

315KB
MD5

4ba03c618eccb7673a226395511dea83
SHA1

c750895954a1fab95f6704a9c3c3e88b0eee7152
SHA256

2f003ca84db5f82fcf36040f7d97baae64e0582e830c8c1cea65c32c3d5b21d5
SHA512

9795a860d1d5522c89a458d1d2e8b7682cebe7c1ce5b13871565b813334bc108850581103f8f07201d62a30596b5e0451cbfc91a13c41b26155e65583be4fbe6

Score

10^/10

evasion trojan keylogger stealer spyware nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

5.9.145.244:50572

206.123.141.99:50572

Mutex

4e576054-870a-4bf5-a92e-d5fb537dabde

Attributes

activate_away_mode
true
backup_connection_host
206.123.141.99
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-04-06T11:52:34.476422736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
50572
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4e576054-870a-4bf5-a92e-d5fb537dabde
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
5.9.145.244
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 4028 RegAsm.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RegAsm.exe

pid process

4028 RegAsm.exe
4028 RegAsm.exe
4028 RegAsm.exe
Drops startup file 1 IoCs

Processes:

Invoice.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe Invoice.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegAsm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4028	RegAsm.exe

pid	process
4028	RegAsm.exe
4028	RegAsm.exe
4028	RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	Invoice.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegAsm.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Invoice.exe

description	pid	process	target process
PID 3576 wrote to memory of 4028	3576	Invoice.exe	RegAsm.exe
PID 3576 wrote to memory of 4028	3576	Invoice.exe	RegAsm.exe
PID 3576 wrote to memory of 4028	3576	Invoice.exe	RegAsm.exe
PID 3576 wrote to memory of 4028	3576	Invoice.exe	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Invoice.exe

pid process

3576 Invoice.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Invoice.exe

description pid process target process

PID 3576 set thread context of 4028 3576 Invoice.exe RegAsm.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

4028 RegAsm.exe
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

pid	process
3576	Invoice.exe

description	pid	process	target process
PID 3576 set thread context of 4028	3576	Invoice.exe	RegAsm.exe

pid	process
4028	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4028-1-0x000000000041E792-mapping.dmp

Download

Analysis

Sharing