nanocore | fe52f1819bdcda1444c78a81ff9308b8d4d84e23408ad295e493fe2703b9b385

General

Target

190408_CoC_list.exe
Size

746KB
MD5

8264f3fb47d6058d34b7a55018814ce9
SHA1

ea8e83651c5ca5e5794004535f11690d34d21632
SHA256

fe52f1819bdcda1444c78a81ff9308b8d4d84e23408ad295e493fe2703b9b385
SHA512

51d36e07384dfc838f8ab0ee1222b31f11637b81e237530b3a71500b27682c703666ed20a1dd5bacd01f0698f3b1a0c0c4e7a46ebe1a2db033bff8b41c33f935

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

fgtrert.duckdns.org:4948

qweerreww.duckdns.org:4948

Mutex

f9d67c34-3506-4888-9966-78d7bc0f3872

Attributes

activate_away_mode
true
backup_connection_host
qweerreww.duckdns.org
backup_dns_server
qweerreww.duckdns.org
buffer_size
65535
build_time
2020-11-08T18:33:11.699418536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4948
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f9d67c34-3506-4888-9966-78d7bc0f3872
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
fgtrert.duckdns.org
primary_dns_server
fgtrert.duckdns.org
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

190408_CoC_list.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 190408_CoC_list.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

190408_CoC_list.exe

description pid process target process

PID 1824 set thread context of 1796 1824 190408_CoC_list.exe 190408_CoC_list.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

190408_CoC_list.exe

pid process

1796 190408_CoC_list.exe
1796 190408_CoC_list.exe
1796 190408_CoC_list.exe
1796 190408_CoC_list.exe
1796 190408_CoC_list.exe
1796 190408_CoC_list.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

190408_CoC_list.exe

pid process

1796 190408_CoC_list.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

190408_CoC_list.exe

description pid process

Token: SeDebugPrivilege 1796 190408_CoC_list.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	190408_CoC_list.exe

description	pid	process	target process
PID 1824 set thread context of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe

pid	process
1796	190408_CoC_list.exe
1796	190408_CoC_list.exe
1796	190408_CoC_list.exe
1796	190408_CoC_list.exe
1796	190408_CoC_list.exe
1796	190408_CoC_list.exe

pid	process
1796	190408_CoC_list.exe

description	pid	process
Token: SeDebugPrivilege	1796	190408_CoC_list.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

190408_CoC_list.exe

description	pid	process	target process
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe
PID 1824 wrote to memory of 1796	1824	190408_CoC_list.exe	190408_CoC_list.exe

C:\Users\Admin\AppData\Local\Temp\190408_CoC_list.exe
"C:\Users\Admin\AppData\Local\Temp\190408_CoC_list.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\190408_CoC_list.exe
"{path}"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-16-0x0000000000490000-0x0000000000493000-memory.dmp

Filesize
12KB

Download
memory/1796-23-0x0000000002060000-0x000000000206D000-memory.dmp

Filesize
52KB

Download
memory/1796-28-0x00000000043C0000-0x00000000043CF000-memory.dmp

Filesize
60KB

Download
memory/1796-27-0x0000000004950000-0x0000000004979000-memory.dmp

Filesize
164KB

Download
memory/1796-17-0x0000000000650000-0x000000000065D000-memory.dmp

Filesize
52KB

Download
memory/1796-9-0x000000000041E792-mapping.dmp

Download
memory/1796-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-18-0x0000000000830000-0x0000000000845000-memory.dmp

Filesize
84KB

Download
memory/1796-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-13-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/1796-14-0x0000000000460000-0x0000000000465000-memory.dmp

Filesize
20KB

Download
memory/1796-15-0x0000000000470000-0x0000000000489000-memory.dmp

Filesize
100KB

Download
memory/1796-26-0x00000000021D0000-0x00000000021DA000-memory.dmp

Filesize
40KB

Download
memory/1796-25-0x0000000002180000-0x000000000218F000-memory.dmp

Filesize
60KB

Download
memory/1796-10-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/1796-19-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/1796-20-0x0000000000870000-0x000000000087C000-memory.dmp

Filesize
48KB

Download
memory/1796-21-0x00000000008C0000-0x00000000008C7000-memory.dmp

Filesize
28KB

Download
memory/1796-22-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Filesize
24KB

Download
memory/1796-24-0x0000000002170000-0x0000000002179000-memory.dmp

Filesize
36KB

Download
memory/1824-3-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1824-7-0x0000000000860000-0x00000000008BC000-memory.dmp

Filesize
368KB

Download
memory/1824-5-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/1824-6-0x00000000003D0000-0x00000000003D4000-memory.dmp

Filesize
16KB

Download
memory/1824-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing