nanocore | 9c62e75f2dc168671bddfe8cad2b102197c10d9039d8917a7637585ff603dbdd

General

Target
LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe
Size 865KB
Sample200831-q96jyv5a36
SHA256 9c62e75f2dc168671bddfe8cad2b102197c10d9039d8917a7637585ff603dbdd
MD5 561d6af019d7b11ea0a12c62f67f5fce
SHA1 fb021ae991487768dee5ba946c083d935071cfea
SHA512 b30188a85e4dc95a594aaf639639050ccd068d656873941ead39e63ee59563ca1a6279d3828b41fc621e7e86b9d81311bb617f959411db2815523dbf80768ece
MD5 SHA1 SHA512

Score

10^/10

keylogger trojan stealer spyware nanocore persistence

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

palmtreesbynastyc.ddns.net:5916

Mutex

c0e4161f-4cf2-4e1e-845b-338a5b95b1c1

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-06-09T00:11:48.237314736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
5916
default_group
STORY OF PADI
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c0e4161f-4cf2-4e1e-845b-338a5b95b1c1
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
palmtreesbynastyc.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Service = "C:\\Program Files (x86)\\IMAP Service\\imapsv.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3816 set thread context of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\IMAP Service\imapsv.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\IMAP Service\imapsv.exe	MSBuild.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3796	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 1cc59d54a77fd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3940	MSBuild.exe
3940	MSBuild.exe
3940	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3940	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2196	svchost.exe
Token: SeCreatePagefilePrivilege	2196	svchost.exe
Token: SeDebugPrivilege	3940	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3796	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	75
PID 3816 wrote to memory of 3796	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	75
PID 3816 wrote to memory of 3796	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	75
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77
PID 3816 wrote to memory of 3940	3816	LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe	77

C:\Users\Admin\AppData\Local\Temp\LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\LI-TAK P0 TVOP CK-20-08-30 203008,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tHfwkemzzjy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8212.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3796
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2196