nanocore | 333d6c935e10800312b76935aa1cfcca4abc448858dc522d7a8b9ead2c89f67f

General

Target

SWIFT 103 202105061212223290 060521.exe
Size

936KB
MD5

3c8eeaf50f0be081edfb94f587346a82
SHA1

ce67ef6d26e8adfced2137ba6a4747cf2fbd2972
SHA256

333d6c935e10800312b76935aa1cfcca4abc448858dc522d7a8b9ead2c89f67f
SHA512

6bd787c36b429a20befff38724136ccb54ec4bf36d1dc9b6313768a27ea49d8c394a5fd12901ec45fc2d2b7797756d402bf372fa093fdba118dbc4ef82822dcf

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

emedoo.ddns.net:5230

127.0.0.1:5230

Mutex

b90524a1-4a4b-41de-ac06-59066a861712

Attributes

activate_away_mode
false
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-01-10T12:34:03.609191636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
5230
default_group
Panda
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
b90524a1-4a4b-41de-ac06-59066a861712
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
emedoo.ddns.net
primary_dns_server
emedoo.ddns.net
request_elevation
true
restart_delay
5000
run_delay
50
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SWIFT 103 202105061212223290 060521.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Manager = "C:\\Program Files (x86)\\ISS Manager\\issmgr.exe"	SWIFT 103 202105061212223290 060521.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SWIFT 103 202105061212223290 060521.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SWIFT 103 202105061212223290 060521.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT 103 202105061212223290 060521.exe

description	pid	process	target process
PID 512 set thread context of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe

Drops file in Program Files directory 2 IoCs

Processes:

SWIFT 103 202105061212223290 060521.exe

description	ioc	process
File created	C:\Program Files (x86)\ISS Manager\issmgr.exe	SWIFT 103 202105061212223290 060521.exe
File opened for modification	C:\Program Files (x86)\ISS Manager\issmgr.exe	SWIFT 103 202105061212223290 060521.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

420 schtasks.exe

pid	process
420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

SWIFT 103 202105061212223290 060521.exepowershell.exepowershell.exepowershell.exeSWIFT 103 202105061212223290 060521.exe

pid	process
512	SWIFT 103 202105061212223290 060521.exe
2260	powershell.exe
3304	powershell.exe
1932	powershell.exe
1332	SWIFT 103 202105061212223290 060521.exe
1332	SWIFT 103 202105061212223290 060521.exe
1332	SWIFT 103 202105061212223290 060521.exe
3304	powershell.exe
1932	powershell.exe
2260	powershell.exe
1932	powershell.exe
2260	powershell.exe
3304	powershell.exe
1332	SWIFT 103 202105061212223290 060521.exe
1332	SWIFT 103 202105061212223290 060521.exe
1332	SWIFT 103 202105061212223290 060521.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SWIFT 103 202105061212223290 060521.exe

pid process

1332 SWIFT 103 202105061212223290 060521.exe

pid	process
1332	SWIFT 103 202105061212223290 060521.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

SWIFT 103 202105061212223290 060521.exepowershell.exepowershell.exepowershell.exeSWIFT 103 202105061212223290 060521.exe

description	pid	process
Token: SeDebugPrivilege	512	SWIFT 103 202105061212223290 060521.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1332	SWIFT 103 202105061212223290 060521.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

SWIFT 103 202105061212223290 060521.exe

description	pid	process	target process
PID 512 wrote to memory of 3304	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 3304	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 3304	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 2260	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 2260	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 2260	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 420	512	SWIFT 103 202105061212223290 060521.exe	schtasks.exe
PID 512 wrote to memory of 420	512	SWIFT 103 202105061212223290 060521.exe	schtasks.exe
PID 512 wrote to memory of 420	512	SWIFT 103 202105061212223290 060521.exe	schtasks.exe
PID 512 wrote to memory of 1932	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 1932	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 1932	512	SWIFT 103 202105061212223290 060521.exe	powershell.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe
PID 512 wrote to memory of 1332	512	SWIFT 103 202105061212223290 060521.exe	SWIFT 103 202105061212223290 060521.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT 103 202105061212223290 060521.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT 103 202105061212223290 060521.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SWIFT 103 202105061212223290 060521.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TuLaGIDaJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TuLaGIDaJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8751.tmp"
2⤵
- Creates scheduled task(s)
PID:420

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TuLaGIDaJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Users\Admin\AppData\Local\Temp\SWIFT 103 202105061212223290 060521.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT 103 202105061212223290 060521.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
70a4eeb3b6874239d70f55e6ae8f2e4a

SHA1
d27c5251a0c66ea91fea69ad7005f3720a761fa5

SHA256
2594fd45a8924c1f8846f28c2b57c5d6f4fb19378f07ad63927a30cb6b14e101

SHA512
f4d47852dfba4ec9f34e862df36abdbdf80fc72578147a539ff15706387a3a1de7c225ea04ac23593ce685c2eb14b285033781745485f1dce2419bcd9d2d5332

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8751.tmp
MD5
533167680729444dd6e53bd3862eb90b

SHA1
3b753002b98ec5502cf1a44aed389c3a2e57fb09

SHA256
57795443e0240bf7dcd0b817d57e7c65453b69fa5fb88105e78ade68584a3659

SHA512
e532ade9cc4b8f45553a6e3eee000c9077365f3282845b2cfa4de90a9d3ce4ecfccbe58ce185d7780a0e0d338c35157db4971264681de06a7970af165e004ed8

Download Submit
memory/420-117-0x0000000000000000-mapping.dmp

Download
memory/512-114-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/1332-129-0x000000000041E792-mapping.dmp

Download
memory/1332-126-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1332-150-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/1932-125-0x0000000000000000-mapping.dmp

Download
memory/1932-152-0x0000000004A02000-0x0000000004A03000-memory.dmp

Filesize
4KB

Download
memory/1932-192-0x000000007E9E0000-0x000000007E9E1000-memory.dmp

Filesize
4KB

Download
memory/1932-159-0x0000000008490000-0x0000000008491000-memory.dmp

Filesize
4KB

Download
memory/1932-183-0x0000000009270000-0x00000000092A3000-memory.dmp

Filesize
204KB

Download
memory/1932-151-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/1932-196-0x0000000004A03000-0x0000000004A04000-memory.dmp

Filesize
4KB

Download
memory/2260-134-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2260-143-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/2260-194-0x000000007ECA0000-0x000000007ECA1000-memory.dmp

Filesize
4KB

Download
memory/2260-149-0x0000000001082000-0x0000000001083000-memory.dmp

Filesize
4KB

Download
memory/2260-197-0x0000000001083000-0x0000000001084000-memory.dmp

Filesize
4KB

Download
memory/2260-123-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/2260-116-0x0000000000000000-mapping.dmp

Download
memory/3304-127-0x0000000006F20000-0x0000000006F21000-memory.dmp

Filesize
4KB

Download
memory/3304-156-0x0000000007C70000-0x0000000007C71000-memory.dmp

Filesize
4KB

Download
memory/3304-153-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/3304-145-0x0000000007550000-0x0000000007551000-memory.dmp

Filesize
4KB

Download
memory/3304-193-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/3304-147-0x0000000001002000-0x0000000001003000-memory.dmp

Filesize
4KB

Download
memory/3304-195-0x0000000001003000-0x0000000001004000-memory.dmp

Filesize
4KB

Download
memory/3304-144-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/3304-137-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/3304-140-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/3304-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads