nanocore | 430a7e324ab686d71a38548850bb90d018b0d7aec9cdbccb7289beb4d09f5a9f

General

Target
Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe
Size 489KB
Sample200721-kc9pexht26
SHA256 430a7e324ab686d71a38548850bb90d018b0d7aec9cdbccb7289beb4d09f5a9f
MD5 10862bd9538040e6ce9d8c093d9e5abc
SHA1 96be2d74c24287941e0c683e920cdff848efa2c1
SHA512 bbb44029fb769fb266b3e42b7e0e0fed6365c98ec61b0049fd1533f93eff691f3bedcf9ce48f816d7f39bfdc31146d2ca4916f6c5f3be2c3da63ed18504a0d99
MD5 SHA1 SHA512

Score

10^/10

evasion trojan keylogger stealer spyware nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

postnl.duckdns.org:1969

Mutex

03803fb4-9846-4772-b30e-fac43bb55ddb

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-04-27T07:08:14.039616336Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
1969
default_group
POSTNL
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
03803fb4-9846-4772-b30e-fac43bb55ddb
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
postnl.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1632	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	27
PID 1492 wrote to memory of 1632	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	27
PID 1492 wrote to memory of 1632	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	27
PID 1492 wrote to memory of 1632	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	27
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29
PID 1492 wrote to memory of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe
1640	MSBuild.exe
1640	MSBuild.exe
1640	MSBuild.exe
1640	MSBuild.exe
1640	MSBuild.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1640	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe	29

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe
Token: SeDebugPrivilege	1640	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	MSBuild.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1632	schtasks.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe
"C:\Users\Admin\AppData\Local\Temp\Teklif açıklaması bilgileri Z0T5nOBüyükşehir Mh.Cumhuriyet Cdoc.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Checks BIOS information in registry
PID:1492
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yzgSDq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8352.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: GetForegroundWindowSpam
  - Checks whether UAC is enabled
  PID:1640