nanocore | c8d57922491f40b0c3e2ea9b0aff04df0de89ae9a6525508868134d1caca3113

General

Target

d9b7fb50628a76fe7603d82f6f0c0bd8.exe
Size

510KB
MD5

d9b7fb50628a76fe7603d82f6f0c0bd8
SHA1

019ef807727684992fefd8dc47bdcc2593419389
SHA256

c8d57922491f40b0c3e2ea9b0aff04df0de89ae9a6525508868134d1caca3113
SHA512

e966f22d4b151262c4177913d38d7b733565d5f75324cfcf3a61e56168a32bd848aeadc4cdcfe8d66d747d8926eadf1163219ba2360fcd368e2eb179d7ee8412

Score

10^/10

nanocore evasion keylogger persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

godisgood1.hopto.org:7712

Mutex

9ed8d108-2eb1-4e23-9679-783796e4baff

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-04-23T17:16:53.813634136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7712
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9ed8d108-2eb1-4e23-9679-783796e4baff
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
godisgood1.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Host = "C:\\Program Files (x86)\\LAN Host\\lanhost.exe"	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description pid process target process

PID 1724 set thread context of 1708 1724 d9b7fb50628a76fe7603d82f6f0c0bd8.exe d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	pid	process	target process
PID 1724 set thread context of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Drops file in Program Files directory 2 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	ioc	process
File created	C:\Program Files (x86)\LAN Host\lanhost.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
File opened for modification	C:\Program Files (x86)\LAN Host\lanhost.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

272 schtasks.exe
268 schtasks.exe

pid	process
272	schtasks.exe
268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

pid	process
1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

pid process

1708 d9b7fb50628a76fe7603d82f6f0c0bd8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description pid process

Token: SeDebugPrivilege 1708 d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	pid	process
Token: SeDebugPrivilege	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exed9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	pid	process	target process
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1724 wrote to memory of 1708	1724	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 1708 wrote to memory of 268	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 268	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 268	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 268	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 272	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 272	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 272	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 1708 wrote to memory of 272	1708	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\d9b7fb50628a76fe7603d82f6f0c0bd8.exe
"C:\Users\Admin\AppData\Local\Temp\d9b7fb50628a76fe7603d82f6f0c0bd8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\d9b7fb50628a76fe7603d82f6f0c0bd8.exe
"{path}"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "LAN Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1564.tmp"
3⤵
- Creates scheduled task(s)
PID:268

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "LAN Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp168E.tmp"
3⤵
- Creates scheduled task(s)
PID:272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1564.tmp
MD5
07e698ee1356499bb21f852c727311db

SHA1
a7e0274018f4b1cc2ee6389339712d38580d740e

SHA256
80930afbfad1b824af5a43d3d0029385f846d5d1faa2d59c8b9859df5e4ae055

SHA512
d7d9a43521a8eb949408510636bdbca1b6b7bd069a50596fcd21ac86358fae88c0458e828193994aecc482df801cec47d173a55946465a273f689a02bfe0cbb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp168E.tmp
MD5
54865f98871478b2b88b7f8aa6100915

SHA1
6f8667f1ce25cebee2a7b460668736ff6bcfac54

SHA256
287f7b4372926ff59bb9a14bdfc00ad63f92af8efdb2e14f6f6baf31878fd44e

SHA512
caba0bd0cb0eda0710291f9754cfdef1a3d8fdb8b6d07f5d3e4d1e7b09c87f37032287ddef0a75485d6e685afa3510ee64453662e6c8d223ae171b392b58e493

Download Submit
memory/268-67-0x0000000000000000-mapping.dmp

Download
memory/272-69-0x0000000000000000-mapping.dmp

Download
memory/1708-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1708-64-0x000000000041E792-mapping.dmp

Download
memory/1708-66-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1724-60-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1724-61-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/1724-62-0x0000000002151000-0x0000000002152000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads