nanocore | 244e2f212245708bd757b50107c8d221e842a683c258f16b744be653fde53c73

General

Target

Transaction_Details.exe
Size

436KB
MD5

5257be13506bef5fadcc0794131afc65
SHA1

220e7a1680a4e0773430a7691448b556ebad437a
SHA256

244e2f212245708bd757b50107c8d221e842a683c258f16b744be653fde53c73
SHA512

1e24bbffb4cae58f1a2aa423d80d00723623ef1d74e9987069366606cc78d6fc5e4a39be112a5f491f9e2211ffae5cc072a41a22787b674326dcd5e8fbe6357b

Score

10^/10

persistence evasion trojan keylogger stealer spyware nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

45.77.147.196:24980

ufok.duckdns.org:24980

Mutex

b4474f1d-f922-4f98-b638-5c6cbc8c6590

Attributes

activate_away_mode
true
backup_connection_host
ufok.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-04-19T16:57:17.983830036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
24980
default_group
men
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
b4474f1d-f922-4f98-b638-5c6cbc8c6590
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
45.77.147.196
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

Transaction_Details.exeRegSvcs.exeelurA.czg.exeelurA.czg.exe

description	pid	process	target process
PID 1420 wrote to memory of 784	1420	Transaction_Details.exe	schtasks.exe
PID 1420 wrote to memory of 784	1420	Transaction_Details.exe	schtasks.exe
PID 1420 wrote to memory of 784	1420	Transaction_Details.exe	schtasks.exe
PID 1420 wrote to memory of 784	1420	Transaction_Details.exe	schtasks.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1080	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1420 wrote to memory of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1076 wrote to memory of 1532	1076	RegSvcs.exe	cmd.exe
PID 1076 wrote to memory of 1532	1076	RegSvcs.exe	cmd.exe
PID 1076 wrote to memory of 1532	1076	RegSvcs.exe	cmd.exe
PID 1076 wrote to memory of 1532	1076	RegSvcs.exe	cmd.exe
PID 1076 wrote to memory of 1532	1076	RegSvcs.exe	cmd.exe
PID 1076 wrote to memory of 1532	1076	RegSvcs.exe	cmd.exe
PID 1076 wrote to memory of 1112	1076	RegSvcs.exe	elurA.czg.exe
PID 1076 wrote to memory of 1112	1076	RegSvcs.exe	elurA.czg.exe
PID 1076 wrote to memory of 1112	1076	RegSvcs.exe	elurA.czg.exe
PID 1076 wrote to memory of 1112	1076	RegSvcs.exe	elurA.czg.exe
PID 1112 wrote to memory of 1048	1112	elurA.czg.exe	schtasks.exe
PID 1112 wrote to memory of 1048	1112	elurA.czg.exe	schtasks.exe
PID 1112 wrote to memory of 1048	1112	elurA.czg.exe	schtasks.exe
PID 1112 wrote to memory of 1048	1112	elurA.czg.exe	schtasks.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 1112 wrote to memory of 596	1112	elurA.czg.exe	elurA.czg.exe
PID 596 wrote to memory of 932	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 932	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 932	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 932	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 896	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 896	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 896	596	elurA.czg.exe	schtasks.exe
PID 596 wrote to memory of 896	596	elurA.czg.exe	schtasks.exe
PID 1076 wrote to memory of 1640	1076	RegSvcs.exe	pCzEvwf.y.exe
PID 1076 wrote to memory of 1640	1076	RegSvcs.exe	pCzEvwf.y.exe
PID 1076 wrote to memory of 1640	1076	RegSvcs.exe	pCzEvwf.y.exe
PID 1076 wrote to memory of 1640	1076	RegSvcs.exe	pCzEvwf.y.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

elurA.czg.exe

pid process

596 elurA.czg.exe
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

784 schtasks.exe
1048 schtasks.exe
932 schtasks.exe
896 schtasks.exe
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Transaction_Details.exeelurA.czg.exe

description pid process

Token: SeDebugPrivilege 1420 Transaction_Details.exe
Token: SeDebugPrivilege 596 elurA.czg.exe
Loads dropped DLL 2 IoCs

Processes:

RegSvcs.exe

pid process

1076 RegSvcs.exe
1076 RegSvcs.exe

pid	process
596	elurA.czg.exe

pid	process
784	schtasks.exe
1048	schtasks.exe
932	schtasks.exe
896	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1420	Transaction_Details.exe
Token: SeDebugPrivilege	596	elurA.czg.exe

pid	process
1076	RegSvcs.exe
1076	RegSvcs.exe

Drops file in Program Files directory 4 IoCs

Processes:

RegSvcs.exeelurA.czg.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft DN1\sqlmap.dll	RegSvcs.exe
File created	C:\Program Files (x86)\WAN Subsystem\wanss.exe	elurA.czg.exe
File opened for modification	C:\Program Files (x86)\WAN Subsystem\wanss.exe	elurA.czg.exe
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	RegSvcs.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\HniEcAz = "0"	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\vbxdmBu = "0"	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Transaction_Details.exeelurA.czg.exe

pid process

1420 Transaction_Details.exe
596 elurA.czg.exe
596 elurA.czg.exe
596 elurA.czg.exe
596 elurA.czg.exe
596 elurA.czg.exe
596 elurA.czg.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegSvcs.exe

pid process

1076 RegSvcs.exe
1076 RegSvcs.exe

pid	process
1420	Transaction_Details.exe
596	elurA.czg.exe
596	elurA.czg.exe
596	elurA.czg.exe
596	elurA.czg.exe
596	elurA.czg.exe
596	elurA.czg.exe

pid	process
1076	RegSvcs.exe
1076	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Transaction_Details.exeelurA.czg.exe

description	pid	process	target process
PID 1420 set thread context of 1076	1420	Transaction_Details.exe	RegSvcs.exe
PID 1112 set thread context of 596	1112	elurA.czg.exe	elurA.czg.exe

Executes dropped EXE 3 IoCs

Processes:

elurA.czg.exeelurA.czg.exepCzEvwf.y.exe

pid process

1112 elurA.czg.exe
596 elurA.czg.exe
1640 pCzEvwf.y.exe

pid	process
1112	elurA.czg.exe
596	elurA.czg.exe
1640	pCzEvwf.y.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

elurA.czg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Subsystem = "C:\\Program Files (x86)\\WAN Subsystem\\wanss.exe"	elurA.czg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

elurA.czg.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA elurA.czg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	elurA.czg.exe

C:\Users\Admin\AppData\Local\Temp\Transaction_Details.exe
"C:\Users\Admin\AppData\Local\Temp\Transaction_Details.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bzBgboNvDgFI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD1F.tmp"
2⤵
- Creates scheduled task(s)
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
PID:1076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:1532

C:\Users\Admin\AppData\Roaming\elurA.czg.exe
"C:\Users\Admin\AppData\Roaming\elurA.czg.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1112

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wriKqTsY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp112F.tmp"
4⤵
- Creates scheduled task(s)
PID:1048

C:\Users\Admin\AppData\Roaming\elurA.czg.exe
"{path}"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Adds Run entry to start application
- Checks whether UAC is enabled
PID:596

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp13CE.tmp"
5⤵
- Creates scheduled task(s)
PID:932

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "WAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp147A.tmp"
5⤵
- Creates scheduled task(s)
PID:896

C:\Users\Admin\AppData\Roaming\pCzEvwf.y.exe
"C:\Users\Admin\AppData\Roaming\pCzEvwf.y.exe"
3⤵
- Executes dropped EXE
PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp112F.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp13CE.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp147A.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAD1F.tmp

Download Submit
C:\Users\Admin\AppData\Roaming\elurA.czg.exe

Download Submit
C:\Users\Admin\AppData\Roaming\elurA.czg.exe

Download Submit
C:\Users\Admin\AppData\Roaming\elurA.czg.exe

Download Submit
C:\Users\Admin\AppData\Roaming\pCzEvwf.y.exe

Download Submit
C:\Users\Admin\AppData\Roaming\pCzEvwf.y.exe

Download Submit
\Users\Admin\AppData\Roaming\elurA.czg.exe

Download Submit
\Users\Admin\AppData\Roaming\pCzEvwf.y.exe

Download Submit
memory/596-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/596-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/596-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/596-19-0x000000000041E792-mapping.dmp

Download
memory/784-2-0x0000000000000000-mapping.dmp

Download
memory/896-25-0x0000000000000000-mapping.dmp

Download
memory/932-23-0x0000000000000000-mapping.dmp

Download
memory/1048-16-0x0000000000000000-mapping.dmp

Download
memory/1076-4-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1076-6-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1076-5-0x0000000000405907-mapping.dmp

Download
memory/1112-11-0x0000000000000000-mapping.dmp

Download
memory/1420-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1532-9-0x0000000000000000-mapping.dmp

Download
memory/1532-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1532-7-0x0000000000000000-mapping.dmp

Download
memory/1640-28-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads