nanocore | 2d66e25ef6e9edfefee476cc8d967809bfebe8f5751c641b13bcdb99b768b754

General

Target
65ed5babc4fae254eb765daf211ca416.exe
Size 1.2MB
Sample201209-zazvb7fr7e
SHA256 2d66e25ef6e9edfefee476cc8d967809bfebe8f5751c641b13bcdb99b768b754
MD5 65ed5babc4fae254eb765daf211ca416
SHA1 3d0bfae4371c70659869e9911c0e55052d61fa0c
SHA512 cab68db8f117a6e3122e52376fc9e7d00decb100fdbd44b26939d0049e1a7905e4df3a472aebbceb8cc9b948038dc6fe36ea2c31ae9fdef6e043a913fd2fb185
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

vremenew.ddns.net:83
79.134.225.12:83

Mutex

fac91458-ea4d-4a87-9c9a-7f5e75997cd1

Attributes

activate_away_mode
true
backup_connection_host
79.134.225.12
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-07-24T04:38:13.387519336Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
83
default_group
A NEW LIFE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
fac91458-ea4d-4a87-9c9a-7f5e75997cd1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
vremenew.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe"	65ed5babc4fae254eb765daf211ca416.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	65ed5babc4fae254eb765daf211ca416.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3336 set thread context of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 2208 set thread context of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 set thread context of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SMTP Manager\smtpmgr.exe	65ed5babc4fae254eb765daf211ca416.exe
File opened for modification	C:\Program Files (x86)\SMTP Manager\smtpmgr.exe	65ed5babc4fae254eb765daf211ca416.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	65ed5babc4fae254eb765daf211ca416.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	65ed5babc4fae254eb765daf211ca416.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2208	65ed5babc4fae254eb765daf211ca416.exe
2208	65ed5babc4fae254eb765daf211ca416.exe
2208	65ed5babc4fae254eb765daf211ca416.exe
2208	65ed5babc4fae254eb765daf211ca416.exe
2208	65ed5babc4fae254eb765daf211ca416.exe
2208	65ed5babc4fae254eb765daf211ca416.exe
1264	vbc.exe
1264	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	65ed5babc4fae254eb765daf211ca416.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	65ed5babc4fae254eb765daf211ca416.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 3336 wrote to memory of 2208	3336	65ed5babc4fae254eb765daf211ca416.exe	78
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 3948	2208	65ed5babc4fae254eb765daf211ca416.exe	79
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80
PID 2208 wrote to memory of 1264	2208	65ed5babc4fae254eb765daf211ca416.exe	80

C:\Users\Admin\AppData\Local\Temp\65ed5babc4fae254eb765daf211ca416.exe
"C:\Users\Admin\AppData\Local\Temp\65ed5babc4fae254eb765daf211ca416.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\65ed5babc4fae254eb765daf211ca416.exe
  "C:\Users\Admin\AppData\Local\Temp\65ed5babc4fae254eb765daf211ca416.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2208
- - \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
    "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\nsmer4pf.0ls"
    3⤵
    PID:3948
- - \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
    "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\fnwl4o4n.yo5"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1264