nanocore | ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7

General

Target
ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe
Size 1.2MB
Sample201109-fw83txr65x
SHA256 ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7
MD5 a22e266f9cf64e748b9395da7454d556
SHA1 183667c77658e1b5d7159448752762fcf63e1ae4
SHA512 e6261392f96d0d018d9c525a2a79e5fcade80817fc3d7e8bf1ebdb4074fa7744d171e7dc3a7d1d030e8850eb92497233f4bad99c002e04de0ed2f917dcb66ff3
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

178.239.21.163:56732

Mutex

b0b97e1a-dfb4-45c6-afdf-04b37abe1f5d

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-11-30T10:06:12.001773636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
56732
default_group
hashw
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
b0b97e1a-dfb4-45c6-afdf-04b37abe1f5d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
178.239.21.163
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\appraiser.url	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe"	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 756	580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe	75

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SMTP Manager\smtpmgr.exe	RegAsm.exe
File created	C:\Program Files (x86)\SMTP Manager\smtpmgr.exe	RegAsm.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2916	schtasks.exe
2408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
756	RegAsm.exe
756	RegAsm.exe
756	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe
580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe
580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe
580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe
580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 756	580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe	75
PID 580 wrote to memory of 756	580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe	75
PID 580 wrote to memory of 756	580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe	75
PID 580 wrote to memory of 756	580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe	75
PID 580 wrote to memory of 756	580	ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe	75
PID 756 wrote to memory of 2916	756	RegAsm.exe	76
PID 756 wrote to memory of 2916	756	RegAsm.exe	76
PID 756 wrote to memory of 2916	756	RegAsm.exe	76
PID 756 wrote to memory of 2408	756	RegAsm.exe	78
PID 756 wrote to memory of 2408	756	RegAsm.exe	78
PID 756 wrote to memory of 2408	756	RegAsm.exe	78

C:\Users\Admin\AppData\Local\Temp\ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe
"C:\Users\Admin\AppData\Local\Temp\ffffd192ab79755901f078b3f7c38faa29e8d8a944466a9ea6cd0a9c69a97ee7.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "SMTP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9E1A.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2916
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "SMTP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9F73.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2408