nanocore | dbfc1426b8273f1490e9f8b61929a3e00fdeefaaef7a4400a1dae2ed2f953a38

General

Target
f359c569b703f59767d4f322c08ffd1b.exe
Size 886KB
Sample210823-bdtfck1mx6
SHA256 dbfc1426b8273f1490e9f8b61929a3e00fdeefaaef7a4400a1dae2ed2f953a38
MD5 f359c569b703f59767d4f322c08ffd1b
SHA1 176ff19dad6778406d0ce0033a3f4116a2877f57
SHA512 d143905bb52e0260e40da5a77158066ede52721f4bac7a769f67078565fc886f9cc15f8228813c23f9c41063b73195dde17e06808c3fbf06bd9b0e6eb1f0c19e
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

tzitziklishop.ddns.net:1665

Mutex

76131181-f427-4fea-9060-b76d3b69a321

Attributes

activate_away_mode
true
backup_connection_host
tzitziklishop.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-05-29T02:49:42.057419436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1665
default_group
AUGUST
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
76131181-f427-4fea-9060-b76d3b69a321
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tzitziklishop.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Service\dpisv.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisv.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1296	schtasks.exe
1384	schtasks.exe
1988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1016	f359c569b703f59767d4f322c08ffd1b.exe
1356	RegSvcs.exe
1356	RegSvcs.exe
1356	RegSvcs.exe
1356	RegSvcs.exe
1356	RegSvcs.exe
1356	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1356	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	f359c569b703f59767d4f322c08ffd1b.exe
Token: SeDebugPrivilege	1356	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1296	1016	f359c569b703f59767d4f322c08ffd1b.exe	29
PID 1016 wrote to memory of 1296	1016	f359c569b703f59767d4f322c08ffd1b.exe	29
PID 1016 wrote to memory of 1296	1016	f359c569b703f59767d4f322c08ffd1b.exe	29
PID 1016 wrote to memory of 1296	1016	f359c569b703f59767d4f322c08ffd1b.exe	29
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1016 wrote to memory of 1356	1016	f359c569b703f59767d4f322c08ffd1b.exe	31
PID 1356 wrote to memory of 1384	1356	RegSvcs.exe	32
PID 1356 wrote to memory of 1384	1356	RegSvcs.exe	32
PID 1356 wrote to memory of 1384	1356	RegSvcs.exe	32
PID 1356 wrote to memory of 1384	1356	RegSvcs.exe	32
PID 1356 wrote to memory of 1988	1356	RegSvcs.exe	34
PID 1356 wrote to memory of 1988	1356	RegSvcs.exe	34
PID 1356 wrote to memory of 1988	1356	RegSvcs.exe	34
PID 1356 wrote to memory of 1988	1356	RegSvcs.exe	34

C:\Users\Admin\AppData\Local\Temp\f359c569b703f59767d4f322c08ffd1b.exe
"C:\Users\Admin\AppData\Local\Temp\f359c569b703f59767d4f322c08ffd1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uLYBYmiNfIUD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA2B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1296
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC2D2.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC39E.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1988