nanocore | b4e2d864ec03943310548bfbc963a0848bd08e088429c5ce05759face5d380d2

Analysis

max time kernel
144s
max time network
183s
platform
windows7_x64
resource
win7v20210408
submitted
11-10-2021 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a4a8643db95a8c0fe52af8675a5d1b1.exe
Size

997KB
MD5

9a4a8643db95a8c0fe52af8675a5d1b1
SHA1

c6beb75cbc168f9224ace74c0dcfb29df6197e82
SHA256

b4e2d864ec03943310548bfbc963a0848bd08e088429c5ce05759face5d380d2
SHA512

05d404c9422c2da367135f616a8b61b6adc68dc3f8f0b3a070f2071ec01de8c2aeafe5a63aea6e306fdfd299c43ef792efcfd9b555dcda9b3ff9e44872a8b4c0

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

strongodss.ddns.net:48562

185.19.85.175:48562

Mutex

ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2021-04-20T00:12:13.961451136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
48562
default_group
HOBBIT
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
strongodss.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

cjlaro.pif

pid process

1996 cjlaro.pif

pid	process
1996	cjlaro.pif

Loads dropped DLL 4 IoCs

Processes:

9a4a8643db95a8c0fe52af8675a5d1b1.exe

pid	process
2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe
2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe
2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe
2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.execjlaro.pif

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe"	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cjlaro.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\77066510\\cjlaro.pif C:\\Users\\Admin\\77066510\\txoxpdjc.qnr"	cjlaro.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\77066510\\Update.vbs"	cjlaro.pif

Suspicious use of SetThreadContext 1 IoCs

Processes:

cjlaro.pif

description pid process target process

PID 1996 set thread context of 1464 1996 cjlaro.pif RegSvcs.exe

description	pid	process	target process
PID 1996 set thread context of 1464	1996	cjlaro.pif	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Program Files (x86)\DPI Service\dpisv.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisv.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

792 schtasks.exe
544 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

RegSvcs.exe

pid process

1464 RegSvcs.exe
1464 RegSvcs.exe
1464 RegSvcs.exe
1464 RegSvcs.exe
1464 RegSvcs.exe
1464 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

1464 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1464 RegSvcs.exe
Token: SeDebugPrivilege 1464 RegSvcs.exe

pid	process
792	schtasks.exe
544	schtasks.exe

pid	process
1464	RegSvcs.exe
1464	RegSvcs.exe
1464	RegSvcs.exe
1464	RegSvcs.exe
1464	RegSvcs.exe
1464	RegSvcs.exe

pid	process
1464	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1464	RegSvcs.exe
Token: SeDebugPrivilege	1464	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

9a4a8643db95a8c0fe52af8675a5d1b1.execjlaro.pifRegSvcs.exe

description	pid	process	target process
PID 2004 wrote to memory of 1996	2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 2004 wrote to memory of 1996	2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 2004 wrote to memory of 1996	2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 2004 wrote to memory of 1996	2004	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1996 wrote to memory of 1464	1996	cjlaro.pif	RegSvcs.exe
PID 1464 wrote to memory of 792	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 792	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 792	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 792	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 544	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 544	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 544	1464	RegSvcs.exe	schtasks.exe
PID 1464 wrote to memory of 544	1464	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\9a4a8643db95a8c0fe52af8675a5d1b1.exe
"C:\Users\Admin\AppData\Local\Temp\9a4a8643db95a8c0fe52af8675a5d1b1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\77066510\cjlaro.pif
  "C:\Users\Admin\77066510\cjlaro.pif" txoxpdjc.qnr
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2B64.tmp"
      4⤵
      Creates scheduled task(s)
      PID:792
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2DE5.tmp"
      4⤵
      Creates scheduled task(s)
      PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
C:\Users\Admin\77066510\hrennftnds.cpl

MD5
51b278bb20ba6b5c39b96e40b19a591f

SHA1
ccf1834f98327a25b1404ef9d679b9d8a29d5330

SHA256
b68324e9d8a2669f261b06af1f96da4cd8360cef79f76e2af45ea7e423f96c2d

SHA512
0c7b27f4227069385d57cc4983a40ddf55a782dce47a7bff2a484c1ae92c0c66fcc7804b7ab25ca175939a6f4816b6e769d69229052f01d94e8ee7d8eefc4d91

Download Submit
C:\Users\Admin\77066510\mbchmfnast.lfh

MD5
fe4f919f7fd004d0d1c5c89bcf638d11

SHA1
11af89c8ed4069e553fa20f204d1c8c78c60505f

SHA256
bf5e0a807796017b22886d1c734d579dc22cdd47a2a26560960908bb05baa6b8

SHA512
87cb95067da0e57dea4e853e3bb23ad7df79489a570c0182271461ff7512ba889497a756f6b1df33561bec569ad6d7aa171bb8e2fd7940a21470960c84265b49

Download Submit
C:\Users\Admin\77066510\txoxpdjc.qnr

MD5
a6b5973b2ab8621e18de5325194d4217

SHA1
ae4f38f9d99fe7caa0dfd1a8c20f9a8645c1ad19

SHA256
9f205b1613138a4ceb7942223c7654d575062ecb54d3cf54cdf1bb3e56bc2a6e

SHA512
938cd33cdc47f8bf9e588c9c2d4d9df17c3866d69cd44527f08003cc1f50a96bddde7ad268d4ff3b5cddebaeac44c9a888433172d5747b3ab419283d57414be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B64.tmp

MD5
8cad1b41587ced0f1e74396794f31d58

SHA1
11054bf74fcf5e8e412768035e4dae43aa7b710f

SHA256
3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c

SHA512
99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2DE5.tmp

MD5
a9af285136db016a568e4a53208f21d0

SHA1
e1afef2b7ee8ae945353315daa19a15574b435b7

SHA256
7dce876e35550f4a5b8ce8a8bbab3b0ccd7c5b8660f9db4b832466b77e3a8b7c

SHA512
80a1f5e463a87cddc0f66336e2dc4262daf98984c6f6c662c3615d615ebe7c58677c3d694edb3bd7816ccee969aae967c7efe8526ba423f274ac1210c0c8bd6e

Download Submit
\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
memory/544-79-0x0000000000000000-mapping.dmp

Download
memory/792-77-0x0000000000000000-mapping.dmp

Download
memory/1464-76-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1464-74-0x0000000000260000-0x0000000000789000-memory.dmp

Filesize
5.2MB

Download
memory/1464-73-0x000000000027E792-mapping.dmp

Download
memory/1464-72-0x0000000000260000-0x0000000000789000-memory.dmp

Filesize
5.2MB

Download
memory/1464-71-0x0000000000260000-0x0000000000789000-memory.dmp

Filesize
5.2MB

Download
memory/1464-81-0x0000000000E10000-0x0000000000E15000-memory.dmp

Filesize
20KB

Download
memory/1464-82-0x0000000000E20000-0x0000000000E26000-memory.dmp

Filesize
24KB

Download
memory/1464-83-0x0000000000E30000-0x0000000000E49000-memory.dmp

Filesize
100KB

Download
memory/1464-84-0x0000000000E60000-0x0000000000E63000-memory.dmp

Filesize
12KB

Download
memory/1464-85-0x0000000000BE5000-0x0000000000BF6000-memory.dmp

Filesize
68KB

Download
memory/1996-65-0x0000000000000000-mapping.dmp

Download
memory/2004-60-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download