nanocore | cdbe67339a29bfe3066a18b4e68e9b19e28e449ab21ce23a85ed15e04c5255df

Analysis

max time kernel
151s
max time network
146s
platform
windows10_x64
resource
win10v20210408
submitted
02/08/2021, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2318b60075e442cb6141535e268e4df0.exe
Size 1.2MB
Sample210802-4t6clrfmjs
SHA256 cdbe67339a29bfe3066a18b4e68e9b19e28e449ab21ce23a85ed15e04c5255df
MD5 2318b60075e442cb6141535e268e4df0
SHA1 6d2e6e0bfdb0e649e0079533ecdbe302ff9dc8b5
SHA512 160013eed136f4db2f3ab2b662e62966daa6959c3ff5dbb8125e3e49f8d41e63ca5ca65ffe5f85370e27c39870bfe3d2dc3f09d629665b59e71e7c32a5c94413
MD5 SHA1 SHA512

Score

10^/10

nanocore warzonerat evasion infostealer keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

warzonerat

sdafsdffssffs.ydns.eu:6703

Extracted

Family

nanocore

Version

1.2.2.0

hhjhtggfr.duckdns.org:8234
dertrefg.duckdns.org:8234

Mutex

6a1c2465-7ac5-4f1d-acc5-ef04fcf454c9

Attributes

activate_away_mode
true
backup_connection_host
dertrefg.duckdns.org
backup_dns_server
dertrefg.duckdns.org
buffer_size
65535
build_time
2021-03-26T23:25:40.118592436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8234
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
6a1c2465-7ac5-4f1d-acc5-ef04fcf454c9
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
hhjhtggfr.duckdns.org
primary_dns_server
hhjhtggfr.duckdns.org
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1800 created 848	1800	WerFault.exe	78

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
1032	images.exe
2368	images.exe
2376	images.exe
8	ugoJtBBbq.exe
4588	ugoJtBBbq.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
4560	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe"	ugoJtBBbq.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ugoJtBBbq.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\G.awkJK = "0"	images.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	images.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	images.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	images.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	images.exe
File opened for modification	C:\Windows\System32\rfxvmt.dll	images.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 1032 set thread context of 2376	1032	images.exe	86
PID 8 set thread context of 4588	8	ugoJtBBbq.exe	93

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	images.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	images.exe
File created	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	ugoJtBBbq.exe
File opened for modification	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	ugoJtBBbq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	848	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1032	images.exe
1032	images.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
4588	ugoJtBBbq.exe
4588	ugoJtBBbq.exe
4588	ugoJtBBbq.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
616	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	images.exe
Token: SeDebugPrivilege	2376	images.exe
Token: SeAuditPrivilege	4560	svchost.exe
Token: SeDebugPrivilege	4588	ugoJtBBbq.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	images.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 4796 wrote to memory of 848	4796	2318b60075e442cb6141535e268e4df0.exe	78
PID 848 wrote to memory of 352	848	2318b60075e442cb6141535e268e4df0.exe	79
PID 848 wrote to memory of 352	848	2318b60075e442cb6141535e268e4df0.exe	79
PID 848 wrote to memory of 352	848	2318b60075e442cb6141535e268e4df0.exe	79
PID 848 wrote to memory of 1032	848	2318b60075e442cb6141535e268e4df0.exe	80
PID 848 wrote to memory of 1032	848	2318b60075e442cb6141535e268e4df0.exe	80
PID 848 wrote to memory of 1032	848	2318b60075e442cb6141535e268e4df0.exe	80
PID 352 wrote to memory of 1656	352	cmd.exe	84
PID 352 wrote to memory of 1656	352	cmd.exe	84
PID 352 wrote to memory of 1656	352	cmd.exe	84
PID 1032 wrote to memory of 2368	1032	images.exe	85
PID 1032 wrote to memory of 2368	1032	images.exe	85
PID 1032 wrote to memory of 2368	1032	images.exe	85
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 1032 wrote to memory of 2376	1032	images.exe	86
PID 2376 wrote to memory of 2740	2376	images.exe	87
PID 2376 wrote to memory of 2740	2376	images.exe	87
PID 2376 wrote to memory of 2740	2376	images.exe	87
PID 2376 wrote to memory of 2740	2376	images.exe	87
PID 2376 wrote to memory of 2740	2376	images.exe	87
PID 2376 wrote to memory of 8	2376	images.exe	90
PID 2376 wrote to memory of 8	2376	images.exe	90
PID 2376 wrote to memory of 8	2376	images.exe	90
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93
PID 8 wrote to memory of 4588	8	ugoJtBBbq.exe	93

C:\Users\Admin\AppData\Local\Temp\2318b60075e442cb6141535e268e4df0.exe
"C:\Users\Admin\AppData\Local\Temp\2318b60075e442cb6141535e268e4df0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\2318b60075e442cb6141535e268e4df0.exe
  "C:\Users\Admin\AppData\Local\Temp\2318b60075e442cb6141535e268e4df0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
      4⤵
      PID:1656
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      4⤵
      Executes dropped EXE
      PID:2368
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      4⤵
      Executes dropped EXE
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Roaming\ugoJtBBbq.exe
        
        "C:\Users\Admin\AppData\Roaming\ugoJtBBbq.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:8
      - C:\Users\Admin\AppData\Roaming\ugoJtBBbq.exe
        
        "C:\Users\Admin\AppData\Roaming\ugoJtBBbq.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 564
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:1800

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s TermService
1⤵
PID:3480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-164-0x000000000CB70000-0x000000000CC12000-memory.dmp

Download

memory/8-165-0x000000000ED20000-0x000000000ED54000-memory.dmp

Download

memory/8-159-0x00000000057E0000-0x0000000005CDE000-memory.dmp

Download

memory/8-153-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/848-126-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/848-124-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1032-138-0x0000000005580000-0x0000000005A7E000-memory.dmp

Download

memory/2376-149-0x0000000004490000-0x00000000045CC000-memory.dmp

Download

memory/2376-146-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/2740-148-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/4588-177-0x00000000055A0000-0x00000000055A5000-memory.dmp

Download

memory/4588-176-0x0000000005190000-0x000000000568E000-memory.dmp

Download

memory/4588-178-0x00000000055B0000-0x00000000055C9000-memory.dmp

Download

memory/4588-166-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4588-179-0x0000000005660000-0x0000000005663000-memory.dmp

Download

memory/4796-122-0x000000000CA10000-0x000000000CAA0000-memory.dmp

Download

memory/4796-118-0x0000000005800000-0x0000000005CFE000-memory.dmp

Download

memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/4796-117-0x00000000058A0000-0x00000000058A1000-memory.dmp

Download

memory/4796-116-0x0000000005D00000-0x0000000005D01000-memory.dmp

Download

memory/4796-119-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/4796-120-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Download

memory/4796-121-0x0000000003160000-0x000000000316D000-memory.dmp

Download

memory/4796-123-0x0000000007300000-0x0000000007328000-memory.dmp

Download