nanocore | c8d57922491f40b0c3e2ea9b0aff04df0de89ae9a6525508868134d1caca3113

General

Target

d9b7fb50628a76fe7603d82f6f0c0bd8.exe
Size

510KB
MD5

d9b7fb50628a76fe7603d82f6f0c0bd8
SHA1

019ef807727684992fefd8dc47bdcc2593419389
SHA256

c8d57922491f40b0c3e2ea9b0aff04df0de89ae9a6525508868134d1caca3113
SHA512

e966f22d4b151262c4177913d38d7b733565d5f75324cfcf3a61e56168a32bd848aeadc4cdcfe8d66d747d8926eadf1163219ba2360fcd368e2eb179d7ee8412

Score

10^/10

nanocore evasion keylogger persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

godisgood1.hopto.org:7712

Mutex

9ed8d108-2eb1-4e23-9679-783796e4baff

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-04-23T17:16:53.813634136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7712
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9ed8d108-2eb1-4e23-9679-783796e4baff
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
godisgood1.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe"	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description pid process target process

PID 800 set thread context of 2236 800 d9b7fb50628a76fe7603d82f6f0c0bd8.exe d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	pid	process	target process
PID 800 set thread context of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Drops file in Program Files directory 2 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	ioc	process
File created	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
File opened for modification	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2776 schtasks.exe
2256 schtasks.exe

pid	process
2776	schtasks.exe
2256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

pid	process
2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

pid process

2236 d9b7fb50628a76fe7603d82f6f0c0bd8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description pid process

Token: SeDebugPrivilege 2236 d9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	pid	process
Token: SeDebugPrivilege	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d9b7fb50628a76fe7603d82f6f0c0bd8.exed9b7fb50628a76fe7603d82f6f0c0bd8.exe

description	pid	process	target process
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 800 wrote to memory of 2236	800	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	d9b7fb50628a76fe7603d82f6f0c0bd8.exe
PID 2236 wrote to memory of 2776	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 2236 wrote to memory of 2776	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 2236 wrote to memory of 2776	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 2236 wrote to memory of 2256	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 2236 wrote to memory of 2256	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe
PID 2236 wrote to memory of 2256	2236	d9b7fb50628a76fe7603d82f6f0c0bd8.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\d9b7fb50628a76fe7603d82f6f0c0bd8.exe
"C:\Users\Admin\AppData\Local\Temp\d9b7fb50628a76fe7603d82f6f0c0bd8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\d9b7fb50628a76fe7603d82f6f0c0bd8.exe
"{path}"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UPNP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1EB4.tmp"
3⤵
- Creates scheduled task(s)
PID:2776

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UPNP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp205B.tmp"
3⤵
- Creates scheduled task(s)
PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\d9b7fb50628a76fe7603d82f6f0c0bd8.exe.log
MD5
ef140ef600b2463c9e7dbf064a104046

SHA1
c08fd1853877be95575ea2e860dd8cafef31f54c

SHA256
ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

SHA512
bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1EB4.tmp
MD5
07e698ee1356499bb21f852c727311db

SHA1
a7e0274018f4b1cc2ee6389339712d38580d740e

SHA256
80930afbfad1b824af5a43d3d0029385f846d5d1faa2d59c8b9859df5e4ae055

SHA512
d7d9a43521a8eb949408510636bdbca1b6b7bd069a50596fcd21ac86358fae88c0458e828193994aecc482df801cec47d173a55946465a273f689a02bfe0cbb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp205B.tmp
MD5
af9986f5e128fd8bd3ae748fcba6576d

SHA1
8060072c35108b48649a03be91803b97f1ad40a4

SHA256
f3242f6480b3d1a8f9285135fdce9a201c4802ce062eee4fb41c488a21d53303

SHA512
f35c8e1699905bc972ae48a5a4a9fd33ea04b2d851ffc1cb1d1573a2087121d803b4186a696b2edad10a9c46c388a478e105f5a730020b598aa9f483086dba38

Download Submit
memory/800-114-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/2236-115-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2236-116-0x000000000041E792-mapping.dmp

Download
memory/2236-118-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/2256-121-0x0000000000000000-mapping.dmp

Download
memory/2776-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads