nanocore | 734485ce04b70e2ee276cbb6cf188d7846daef58315e623d078e6fc5b40397b2

General

Target

TBF-21-52100456221SLIP.exe
Size

1.2MB
MD5

d8ecf82a9d13679435f31227b825891b
SHA1

f356d02b5299e9a7d1af75bbf00fdb2be05e6561
SHA256

734485ce04b70e2ee276cbb6cf188d7846daef58315e623d078e6fc5b40397b2
SHA512

fa81c2cbdcfe9d9958bdc8963505b504709f506c14dd2aaa9396c21dcdaae6b1d4c28ef625edff856cb5ea681f4550bcb601a42cbf14daf4c890dbc84193eac9

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.222.57.152:4001

127.0.0.1:4001

Mutex

f9175a76-6792-4aec-8850-9880989a1db8

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-01-31T09:27:36.715855536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4001
default_group
testing1
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f9175a76-6792-4aec-8850-9880989a1db8
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.222.57.152
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

TBF-21-52100456221SLIP.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TBF-21-52100456221SLIP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

TBF-21-52100456221SLIP.exe

description pid process target process

PID 2112 set thread context of 2700 2112 TBF-21-52100456221SLIP.exe TBF-21-52100456221SLIP.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3852 schtasks.exe

description	pid	process	target process
PID 2112 set thread context of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe

pid	process
3852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

TBF-21-52100456221SLIP.exepowershell.exepowershell.exepowershell.exeTBF-21-52100456221SLIP.exe

pid	process
2112	TBF-21-52100456221SLIP.exe
2112	TBF-21-52100456221SLIP.exe
2112	TBF-21-52100456221SLIP.exe
1792	powershell.exe
3928	powershell.exe
2112	TBF-21-52100456221SLIP.exe
3928	powershell.exe
1792	powershell.exe
2456	powershell.exe
2700	TBF-21-52100456221SLIP.exe
2700	TBF-21-52100456221SLIP.exe
2700	TBF-21-52100456221SLIP.exe
2700	TBF-21-52100456221SLIP.exe
2700	TBF-21-52100456221SLIP.exe
2700	TBF-21-52100456221SLIP.exe
3928	powershell.exe
2456	powershell.exe
1792	powershell.exe
2456	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

TBF-21-52100456221SLIP.exe

pid process

2700 TBF-21-52100456221SLIP.exe

pid	process
2700	TBF-21-52100456221SLIP.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

TBF-21-52100456221SLIP.exepowershell.exepowershell.exepowershell.exeTBF-21-52100456221SLIP.exe

description	pid	process
Token: SeDebugPrivilege	2112	TBF-21-52100456221SLIP.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2700	TBF-21-52100456221SLIP.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

TBF-21-52100456221SLIP.exe

description	pid	process	target process
PID 2112 wrote to memory of 1792	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 1792	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 1792	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 3928	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 3928	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 3928	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 3852	2112	TBF-21-52100456221SLIP.exe	schtasks.exe
PID 2112 wrote to memory of 3852	2112	TBF-21-52100456221SLIP.exe	schtasks.exe
PID 2112 wrote to memory of 3852	2112	TBF-21-52100456221SLIP.exe	schtasks.exe
PID 2112 wrote to memory of 2456	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 2456	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 2456	2112	TBF-21-52100456221SLIP.exe	powershell.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe
PID 2112 wrote to memory of 2700	2112	TBF-21-52100456221SLIP.exe	TBF-21-52100456221SLIP.exe

C:\Users\Admin\AppData\Local\Temp\TBF-21-52100456221SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\TBF-21-52100456221SLIP.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TBF-21-52100456221SLIP.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cNkZWbheq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cNkZWbheq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD12C.tmp"
2⤵
- Creates scheduled task(s)
PID:3852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cNkZWbheq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Users\Admin\AppData\Local\Temp\TBF-21-52100456221SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\TBF-21-52100456221SLIP.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
5ea895fe360714ee0cfc6a6f14005d63

SHA1
7c5cc1bdd54b7859a20ebbc32a27578337c231b1

SHA256
7d5fa4ebbc91ad1b45f8533f7dfd94921920c1b4e622a3ad4a984fdf82d735f3

SHA512
270df00fea42e03cf94517925186b76d9ce03bb5dfd7d85f8a9d58cafa610dc094c80e4a7b464129799d952c70da1fc7fea6b619253b2a3f563f202b01a3f629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
8b38db956f46ad3f5fb32b3dcffb83ac

SHA1
7d1bd1634e944e980e05f1d2ca6b77a690b03839

SHA256
baece41e693d01e04d94ec2405f2226d743b30abab17c0927318051e9cc0980b

SHA512
d398a0848b5b6f976839c7bad3cad076df2e5617fd33a181b4b2e7928761795f58a5bf42fa03721a56c6c6731de655bfecbadd3048220094bce2d3bd4281989b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD12C.tmp
MD5
f91c88d7b6f3b94e0093b9be02af7131

SHA1
2cd040fe1bd5d47c0414e84f951906941cf37f61

SHA256
68edf763df725c5f16eb0aeb26122d6ac8accf9ec3dee421157d003454378889

SHA512
f0a7249a28bd3a0c18c2e2522abfda60e1fbde83dba227cee240f9a7c1033fa26e87543567388e77bb69c9c2ac1cbc53c24013c4d6f4ec34b737cb9d52277f5e

Download Submit
memory/1792-194-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1792-139-0x00000000072E0000-0x00000000072E1000-memory.dmp

Filesize
4KB

Download
memory/1792-159-0x00000000042D2000-0x00000000042D3000-memory.dmp

Filesize
4KB

Download
memory/1792-158-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/1792-174-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

Filesize
4KB

Download
memory/1792-179-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/1792-125-0x0000000000000000-mapping.dmp

Download
memory/1792-130-0x0000000004250000-0x0000000004251000-memory.dmp

Filesize
4KB

Download
memory/1792-137-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/1792-195-0x00000000042D3000-0x00000000042D4000-memory.dmp

Filesize
4KB

Download
memory/1792-171-0x0000000007580000-0x0000000007581000-memory.dmp

Filesize
4KB

Download
memory/1792-131-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

Filesize
4KB

Download
memory/2112-120-0x0000000004E40000-0x000000000533E000-memory.dmp

Filesize
5.0MB

Download
memory/2112-116-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/2112-114-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2112-118-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/2112-117-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/2112-124-0x0000000008030000-0x0000000008068000-memory.dmp

Filesize
224KB

Download
memory/2112-119-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/2112-122-0x00000000058C0000-0x00000000058C9000-memory.dmp

Filesize
36KB

Download
memory/2112-123-0x0000000000E00000-0x0000000000E7E000-memory.dmp

Filesize
504KB

Download
memory/2112-121-0x000000007E4F0000-0x000000007E4F1000-memory.dmp

Filesize
4KB

Download
memory/2456-164-0x0000000006CC2000-0x0000000006CC3000-memory.dmp

Filesize
4KB

Download
memory/2456-162-0x0000000006CC0000-0x0000000006CC1000-memory.dmp

Filesize
4KB

Download
memory/2456-198-0x0000000006CC3000-0x0000000006CC4000-memory.dmp

Filesize
4KB

Download
memory/2456-197-0x000000007E380000-0x000000007E381000-memory.dmp

Filesize
4KB

Download
memory/2456-145-0x0000000000000000-mapping.dmp

Download
memory/2700-183-0x0000000006450000-0x0000000006456000-memory.dmp

Filesize
24KB

Download
memory/2700-186-0x0000000006480000-0x000000000648F000-memory.dmp

Filesize
60KB

Download
memory/2700-163-0x0000000004FC0000-0x00000000054BE000-memory.dmp

Filesize
5.0MB

Download
memory/2700-147-0x000000000041E792-mapping.dmp

Download
memory/2700-176-0x0000000006290000-0x000000000629D000-memory.dmp

Filesize
52KB

Download
memory/2700-177-0x00000000062A0000-0x00000000062B5000-memory.dmp

Filesize
84KB

Download
memory/2700-146-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2700-178-0x00000000062D0000-0x00000000062D6000-memory.dmp

Filesize
24KB

Download
memory/2700-181-0x00000000062F0000-0x00000000062FC000-memory.dmp

Filesize
48KB

Download
memory/2700-182-0x0000000006300000-0x0000000006307000-memory.dmp

Filesize
28KB

Download
memory/2700-168-0x00000000052C0000-0x00000000052D9000-memory.dmp

Filesize
100KB

Download
memory/2700-184-0x0000000006460000-0x000000000646D000-memory.dmp

Filesize
52KB

Download
memory/2700-185-0x0000000006470000-0x0000000006479000-memory.dmp

Filesize
36KB

Download
memory/2700-170-0x0000000005CB0000-0x0000000005CB3000-memory.dmp

Filesize
12KB

Download
memory/2700-187-0x00000000064A0000-0x00000000064AA000-memory.dmp

Filesize
40KB

Download
memory/2700-188-0x00000000064B0000-0x00000000064D9000-memory.dmp

Filesize
164KB

Download
memory/2700-189-0x00000000064F0000-0x00000000064FF000-memory.dmp

Filesize
60KB

Download
memory/2700-165-0x00000000052B0000-0x00000000052B5000-memory.dmp

Filesize
20KB

Download
memory/3852-129-0x0000000000000000-mapping.dmp

Download
memory/3928-193-0x000000007ED40000-0x000000007ED41000-memory.dmp

Filesize
4KB

Download
memory/3928-143-0x0000000008440000-0x0000000008441000-memory.dmp

Filesize
4KB

Download
memory/3928-161-0x0000000005192000-0x0000000005193000-memory.dmp

Filesize
4KB

Download
memory/3928-196-0x0000000005193000-0x0000000005194000-memory.dmp

Filesize
4KB

Download
memory/3928-160-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/3928-141-0x0000000007A50000-0x0000000007A51000-memory.dmp

Filesize
4KB

Download
memory/3928-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads