nanocore | 0aae44ceb97790a03f1093278faeb08fbdfbef70ba53d6516428c10644d64132

General

Target
5b86fcaf5ab130c47731cc168a2ca852.exe
Size 745KB
Sample210830-72s3agrl1s
SHA256 0aae44ceb97790a03f1093278faeb08fbdfbef70ba53d6516428c10644d64132
MD5 5b86fcaf5ab130c47731cc168a2ca852
SHA1 e5819a91910f8d8e500118803a3d256b8fc0d5c4
SHA512 7de8897a38bde497440ee44cd2bdfd68c4c26fe228ba6b207712df084872076004106b519c437e7cb99dee3dcfd17e18e30cc8f5de19dafe420e08f7d96fb854
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

tzitziklishop.ddns.net:1665

Mutex

1fee815a-7277-4e27-993a-701d21499d3d

Attributes

activate_away_mode
true
backup_connection_host
tzitziklishop.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-06-07T15:01:49.606133936Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1665
default_group
NEW MONEY
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1fee815a-7277-4e27-993a-701d21499d3d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tzitziklishop.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
936	schtasks.exe
1472	schtasks.exe
2236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
900	5b86fcaf5ab130c47731cc168a2ca852.exe
900	5b86fcaf5ab130c47731cc168a2ca852.exe
900	5b86fcaf5ab130c47731cc168a2ca852.exe
900	5b86fcaf5ab130c47731cc168a2ca852.exe
900	5b86fcaf5ab130c47731cc168a2ca852.exe
1940	RegSvcs.exe
1940	RegSvcs.exe
1940	RegSvcs.exe
1940	RegSvcs.exe
1940	RegSvcs.exe
1940	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	5b86fcaf5ab130c47731cc168a2ca852.exe
Token: SeDebugPrivilege	1940	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 936	900	5b86fcaf5ab130c47731cc168a2ca852.exe	78
PID 900 wrote to memory of 936	900	5b86fcaf5ab130c47731cc168a2ca852.exe	78
PID 900 wrote to memory of 936	900	5b86fcaf5ab130c47731cc168a2ca852.exe	78
PID 900 wrote to memory of 2936	900	5b86fcaf5ab130c47731cc168a2ca852.exe	79
PID 900 wrote to memory of 2936	900	5b86fcaf5ab130c47731cc168a2ca852.exe	79
PID 900 wrote to memory of 2936	900	5b86fcaf5ab130c47731cc168a2ca852.exe	79
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 900 wrote to memory of 1940	900	5b86fcaf5ab130c47731cc168a2ca852.exe	81
PID 1940 wrote to memory of 1472	1940	RegSvcs.exe	82
PID 1940 wrote to memory of 1472	1940	RegSvcs.exe	82
PID 1940 wrote to memory of 1472	1940	RegSvcs.exe	82
PID 1940 wrote to memory of 2236	1940	RegSvcs.exe	84
PID 1940 wrote to memory of 2236	1940	RegSvcs.exe	84
PID 1940 wrote to memory of 2236	1940	RegSvcs.exe	84

C:\Users\Admin\AppData\Local\Temp\5b86fcaf5ab130c47731cc168a2ca852.exe
"C:\Users\Admin\AppData\Local\Temp\5b86fcaf5ab130c47731cc168a2ca852.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GUWmcXnh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A27.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:936
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  PID:2936
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "UPNP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6765.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1472
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "UPNP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp689F.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2236