nanocore | f7db1be127a912d2570301c528decd649d8657c7e261c2f4b6c0cc5ac754409a

General

Target
Price List.Pdf.exe
Size 355KB
Sample201109-2ffpd63ksx
SHA256 f7db1be127a912d2570301c528decd649d8657c7e261c2f4b6c0cc5ac754409a
MD5 c87a570a8d79f7f17be4d75b52485d74
SHA1 487f17795cf68fd34b0f3a2d59d185e7b8474d32
SHA512 b2b860bb5a16dc18cb81b7665c62bc5cce03801e0cb13b865f9bfde18a0c2e8c49243730fb96178e5125de89db9c10a027e982601a7b9f01ae11bf33cfabd433
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

79.134.225.21:1985
127.0.0.1:1985

Mutex

d2fdfe75-eaa8-46d1-90f3-2d45d060fafe

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-09T03:02:00.882088436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1985
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
d2fdfe75-eaa8-46d1-90f3-2d45d060fafe
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
79.134.225.21
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Manager = "C:\\Program Files (x86)\\NTFS Manager\\ntfsmgr.exe"	Price List.Pdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Price List.Pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1004 set thread context of 864	1004	Price List.Pdf.exe	31

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe	Price List.Pdf.exe
File opened for modification	C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe	Price List.Pdf.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1004	Price List.Pdf.exe
864	Price List.Pdf.exe
864	Price List.Pdf.exe
864	Price List.Pdf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
864	Price List.Pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	Price List.Pdf.exe
Token: SeDebugPrivilege	864	Price List.Pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1188	1004	Price List.Pdf.exe	29
PID 1004 wrote to memory of 1188	1004	Price List.Pdf.exe	29
PID 1004 wrote to memory of 1188	1004	Price List.Pdf.exe	29
PID 1004 wrote to memory of 1188	1004	Price List.Pdf.exe	29
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31
PID 1004 wrote to memory of 864	1004	Price List.Pdf.exe	31

C:\Users\Admin\AppData\Local\Temp\Price List.Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Price List.Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VHmGLTNvqFo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6900.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1188
- C:\Users\Admin\AppData\Local\Temp\Price List.Pdf.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:864