nanocore | e102edf045b60201468f4f7910e3ed9d78bcfb0a1e0955bf14faa9ebb2deab8f

General

Target
Swift Message 120520.exe
Size 328KB
Sample201109-2kc2p9598j
SHA256 e102edf045b60201468f4f7910e3ed9d78bcfb0a1e0955bf14faa9ebb2deab8f
MD5 848825e436148030a9ade262741336e1
SHA1 92ca8d03a417aee5801cffabd9e84bf1c11f8e19
SHA512 656f4a6621e1a957519a1a717fba774162d57708d83ddf75d7778f24fc6a5970032312f40ed574a4ab7526a570f8c849af15c1386b70ce99794c46185d53747c
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

fowok.ddns.net:5656
fowok.duckdns.org:5656

Mutex

7489475d-84cb-4045-9bbe-971598b1bb8d

Attributes

activate_away_mode
true
backup_connection_host
fowok.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-02-15T01:59:58.454793136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
5656
default_group
fowok
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7489475d-84cb-4045-9bbe-971598b1bb8d
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
fowok.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Swift Message 120520.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Swift Message 120520.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Swift Message 120520.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Swift Message 120520.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 3500	2868	Swift Message 120520.exe	77

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3500	MSBuild.exe
3500	MSBuild.exe
3500	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3500	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3884	2868	Swift Message 120520.exe	75
PID 2868 wrote to memory of 3884	2868	Swift Message 120520.exe	75
PID 2868 wrote to memory of 3884	2868	Swift Message 120520.exe	75
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77
PID 2868 wrote to memory of 3500	2868	Swift Message 120520.exe	77

C:\Users\Admin\AppData\Local\Temp\Swift Message 120520.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Message 120520.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ExoZYLSTOsWouL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33A8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3884
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3500