nanocore | 23f3571be31eb3b8f4d302672e7babb1260604854506f0b4592c23f5720aac87

General

Target

26lUdCAaHNFDpbO.exe
Size

511KB
MD5

ec5c23f889cab095728f01ebea9bb2bc
SHA1

b739c1bae4c48c348ecd1235c2e3c086c30bb1c3
SHA256

d516adcfb9bbc6694367101aa14aaf6e3fdf9e83100ef2100f3eff33671ff997
SHA512

ee64a29b759346fd1d66770e0eba9385117d7deb1cce2f4f499b1af652f2f3e7e645cdc032ca04cb13a02397236f2912de886e8638588f24d59245ea47021bbc

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

kekevzcmkopdhunbsgwtfcvzcxgjhyegvbcnmgte.ydns.eu:1123

Mutex

08a5c932-0ecd-42cf-9f1a-12d8d9a575e1

Attributes

activate_away_mode
true
backup_connection_host
kekevzcmkopdhunbsgwtfcvzcxgjhyegvbcnmgte.ydns.eu
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-02-07T23:06:34.828470536Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1123
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
08a5c932-0ecd-42cf-9f1a-12d8d9a575e1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

26lUdCAaHNFDpbO.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26lUdCAaHNFDpbO.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

26lUdCAaHNFDpbO.exe

description pid process target process

PID 1840 set thread context of 1604 1840 26lUdCAaHNFDpbO.exe 26lUdCAaHNFDpbO.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1568 schtasks.exe
348 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

26lUdCAaHNFDpbO.exe

pid process

1604 26lUdCAaHNFDpbO.exe
1604 26lUdCAaHNFDpbO.exe
1604 26lUdCAaHNFDpbO.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

26lUdCAaHNFDpbO.exe

pid process

1604 26lUdCAaHNFDpbO.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

26lUdCAaHNFDpbO.exe

description pid process

Token: SeDebugPrivilege 1604 26lUdCAaHNFDpbO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	26lUdCAaHNFDpbO.exe

description	pid	process	target process
PID 1840 set thread context of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe

pid	process
1568	schtasks.exe
348	schtasks.exe

pid	process
1604	26lUdCAaHNFDpbO.exe
1604	26lUdCAaHNFDpbO.exe
1604	26lUdCAaHNFDpbO.exe

pid	process
1604	26lUdCAaHNFDpbO.exe

description	pid	process
Token: SeDebugPrivilege	1604	26lUdCAaHNFDpbO.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

26lUdCAaHNFDpbO.exe26lUdCAaHNFDpbO.exe

description	pid	process	target process
PID 1840 wrote to memory of 1568	1840	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1840 wrote to memory of 1568	1840	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1840 wrote to memory of 1568	1840	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1840 wrote to memory of 1568	1840	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1840 wrote to memory of 1604	1840	26lUdCAaHNFDpbO.exe	26lUdCAaHNFDpbO.exe
PID 1604 wrote to memory of 348	1604	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1604 wrote to memory of 348	1604	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1604 wrote to memory of 348	1604	26lUdCAaHNFDpbO.exe	schtasks.exe
PID 1604 wrote to memory of 348	1604	26lUdCAaHNFDpbO.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\26lUdCAaHNFDpbO.exe
"C:\Users\Admin\AppData\Local\Temp\26lUdCAaHNFDpbO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OWYPfKIUlU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFA0.tmp"
2⤵
- Creates scheduled task(s)
PID:1568

C:\Users\Admin\AppData\Local\Temp\26lUdCAaHNFDpbO.exe
"{path}"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB78C.tmp"
3⤵
- Creates scheduled task(s)
PID:348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAFA0.tmp
MD5
801911fe5f282a31310c51d9e6545af9

SHA1
af0b82624acd7f8d6be0f0176ca47e3b45069909

SHA256
69b2caeebfeae0e2555226a9830edb84bfac4c805423f6bbae7895838fabebc7

SHA512
78fd5ec9e53fc85869b0435b383ecaf9f13d325fb2f7f796eaa84a607085b03c5960c86183911239c56790d2267089932249c05b24097197addbb321491eae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB78C.tmp
MD5
46efe38ebd7abbf8ad6139529ad7273e

SHA1
3191cfd00e5875936038c3fb2cbacd1b81727725

SHA256
64061403115d6ba9fb1fa2148d70434ef92298a909ff4d22ae3afaa9080c4184

SHA512
51617c7f32a4f08d67f1adb1c48fb0dc509ee9be9901ec9725019dd30b5f4496a22e1ee61ecb071e2daa36a334f974e2c8b9a77fd600dd59b7b74bb4f6317347

Download Submit
memory/348-68-0x0000000000000000-mapping.dmp

Download
memory/1568-62-0x0000000000000000-mapping.dmp

Download
memory/1604-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1604-65-0x000000000041E792-mapping.dmp

Download
memory/1604-67-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1840-59-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1840-60-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/1840-61-0x00000000020A1000-0x00000000020A2000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads