nanocore | 04d57be00e1edddcfd5cd6088b4eec44591c6f0a5f9e6a13b9f90e66a24ccc25

General

Target
PostNL klant verzendinformatie document doc.exe
Size 500KB
Sample200716-kx46bcw8a6
SHA256 04d57be00e1edddcfd5cd6088b4eec44591c6f0a5f9e6a13b9f90e66a24ccc25
MD5 96197942f6e4fb122810a1188781d9a1
SHA1 a19f727211c5120a482af60dfca7042f181f5e3a
SHA512 4c4ab690187abfa8b68641dbe02038d91ec56a9898a69a65709cea7d86cc984df9ef1f7d6658d7f3b0fecd3931bccdf14d828ee09b50b54cb32105a32009f45d
MD5 SHA1 SHA512

Score

10^/10

evasion trojan keylogger stealer spyware nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

postnl.duckdns.org:1969

Mutex

03803fb4-9846-4772-b30e-fac43bb55ddb

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-04-27T07:08:14.039616336Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
1969
default_group
POSTNL
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
03803fb4-9846-4772-b30e-fac43bb55ddb
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
postnl.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	PostNL klant verzendinformatie document doc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	PostNL klant verzendinformatie document doc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3796	schtasks.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 3904	3848	PostNL klant verzendinformatie document doc.exe	75

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3904	MSBuild.exe
3904	MSBuild.exe
3904	MSBuild.exe
3904	MSBuild.exe
3904	MSBuild.exe
3904	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3904	MSBuild.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PostNL klant verzendinformatie document doc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PostNL klant verzendinformatie document doc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3796	3848	PostNL klant verzendinformatie document doc.exe	73
PID 3848 wrote to memory of 3796	3848	PostNL klant verzendinformatie document doc.exe	73
PID 3848 wrote to memory of 3796	3848	PostNL klant verzendinformatie document doc.exe	73
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75
PID 3848 wrote to memory of 3904	3848	PostNL klant verzendinformatie document doc.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\PostNL klant verzendinformatie document doc.exe
"C:\Users\Admin\AppData\Local\Temp\PostNL klant verzendinformatie document doc.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlNpaFxnRflL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50E0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3796
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  PID:3904