nanocore | 4f962ebfce324a7e787f683c25c432206b2418df6fdce533e9c373ee074bf155

General

Target
8594b937952f6ea366f2eef4a0e7b8ca.exe
Size 398KB
Sample201109-j3fxc7e7fn
SHA256 4f962ebfce324a7e787f683c25c432206b2418df6fdce533e9c373ee074bf155
MD5 8594b937952f6ea366f2eef4a0e7b8ca
SHA1 7b574583549159a2c3e4ce5d695dc46b79f43bda
SHA512 313d29078c9a878c32e4c93576bc5027fe46ff582bb4e71bc75269e8a194c1ece50c8a330a03860a39f32cc0dd0826e3a5d682ef7d44c5366634db0e9cb8e470
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

qd4sda0v.redirectme.net:8317

Mutex

ecdd569e-07e9-4681-907a-371f0a0a0112

Attributes

activate_away_mode
true
backup_connection_host
qd4sda0v.redirectme.net
backup_dns_server
8.8.4.4
buffer_size
65534
build_time
2020-02-14T23:28:35.660779536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
3987
connection_port
8317
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
29998
keyboard_logging
false
lan_timeout
2497
max_packet_size
1.048576e+07
mutex
ecdd569e-07e9-4681-907a-371f0a0a0112
mutex_timeout
4998
prevent_system_sleep
false
primary_connection_host
qd4sda0v.redirectme.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
4991
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
4994
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
7999

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansv.exe"	8594b937952f6ea366f2eef4a0e7b8ca.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8594b937952f6ea366f2eef4a0e7b8ca.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WAN Service\wansv.exe	8594b937952f6ea366f2eef4a0e7b8ca.exe
File opened for modification	C:\Program Files (x86)\WAN Service\wansv.exe	8594b937952f6ea366f2eef4a0e7b8ca.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4760	8594b937952f6ea366f2eef4a0e7b8ca.exe
2480	8594b937952f6ea366f2eef4a0e7b8ca.exe
2480	8594b937952f6ea366f2eef4a0e7b8ca.exe
2480	8594b937952f6ea366f2eef4a0e7b8ca.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	8594b937952f6ea366f2eef4a0e7b8ca.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe
Token: SeDebugPrivilege	2480	8594b937952f6ea366f2eef4a0e7b8ca.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1172	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	75
PID 4760 wrote to memory of 1172	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	75
PID 4760 wrote to memory of 1172	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	75
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77
PID 4760 wrote to memory of 2480	4760	8594b937952f6ea366f2eef4a0e7b8ca.exe	77

C:\Users\Admin\AppData\Local\Temp\8594b937952f6ea366f2eef4a0e7b8ca.exe
"C:\Users\Admin\AppData\Local\Temp\8594b937952f6ea366f2eef4a0e7b8ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ntJBIKWkwFJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64CA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\8594b937952f6ea366f2eef4a0e7b8ca.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2480