nanocore | ce8b8aedcc40fe73e6bc20b0cbc3c0c4936b4d4dbce86b8e8d9a068d7371211d

Analysis

max time kernel
147s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
30/03/2021, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3302e22d7f1a94196fff9cfe39459f33.exe
Size 1001KB
Sample210330-cj75qredan
SHA256 ce8b8aedcc40fe73e6bc20b0cbc3c0c4936b4d4dbce86b8e8d9a068d7371211d
MD5 3302e22d7f1a94196fff9cfe39459f33
SHA1 1fa58903fbd926c1d6bd4668cf39b37d2821ac93
SHA512 24cc1d3e1279f0f1124232ad1eaf86ef6978f40608b955174b2d2dbbc3e78a5f00ed8c9dec552b223ea1784e8300cb3b29be7c36cf1a1e23230a15edcb8d83c3
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

194.5.98.250:1012
nassiru1144.ddns.net:1012

Mutex

c58032b4-d173-4ca1-842f-62ce41b0e6f4

Attributes

activate_away_mode
true
backup_connection_host
nassiru1144.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-01-07T23:19:24.587306136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1012
default_group
Adoration!!!
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c58032b4-d173-4ca1-842f-62ce41b0e6f4
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
194.5.98.250
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
512	RegSvcs.exe
512	RegSvcs.exe
512	RegSvcs.exe
512	RegSvcs.exe
512	RegSvcs.exe
512	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
512	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2096	4704	3302e22d7f1a94196fff9cfe39459f33.exe	78
PID 4704 wrote to memory of 2096	4704	3302e22d7f1a94196fff9cfe39459f33.exe	78
PID 4704 wrote to memory of 2096	4704	3302e22d7f1a94196fff9cfe39459f33.exe	78
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80
PID 4704 wrote to memory of 512	4704	3302e22d7f1a94196fff9cfe39459f33.exe	80

C:\Users\Admin\AppData\Local\Temp\3302e22d7f1a94196fff9cfe39459f33.exe
"C:\Users\Admin\AppData\Local\Temp\3302e22d7f1a94196fff9cfe39459f33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PwdZrPVyLJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD060.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-28-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/512-29-0x00000000056B3000-0x00000000056B5000-memory.dmp

Download

memory/512-27-0x0000000006590000-0x0000000006593000-memory.dmp

Download

memory/512-26-0x0000000006370000-0x0000000006389000-memory.dmp

Download

memory/512-25-0x0000000005C20000-0x0000000005C2D000-memory.dmp

Download

memory/512-24-0x0000000005720000-0x0000000005725000-memory.dmp

Download

memory/512-17-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Download

memory/512-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4704-2-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Download

memory/4704-12-0x00000000057D0000-0x0000000005838000-memory.dmp

Download

memory/4704-11-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/4704-10-0x0000000004C10000-0x0000000004C19000-memory.dmp

Download

memory/4704-9-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/4704-8-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/4704-7-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/4704-6-0x00000000050D0000-0x00000000050D1000-memory.dmp

Download

memory/4704-5-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmp

Download