nanocore | b4e2d864ec03943310548bfbc963a0848bd08e088429c5ce05759face5d380d2

General

Target

9a4a8643db95a8c0fe52af8675a5d1b1.exe
Size

997KB
MD5

9a4a8643db95a8c0fe52af8675a5d1b1
SHA1

c6beb75cbc168f9224ace74c0dcfb29df6197e82
SHA256

b4e2d864ec03943310548bfbc963a0848bd08e088429c5ce05759face5d380d2
SHA512

05d404c9422c2da367135f616a8b61b6adc68dc3f8f0b3a070f2071ec01de8c2aeafe5a63aea6e306fdfd299c43ef792efcfd9b555dcda9b3ff9e44872a8b4c0

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

strongodss.ddns.net:48562

185.19.85.175:48562

Mutex

ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2021-04-20T00:12:13.961451136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
48562
default_group
HOBBIT
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
strongodss.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

cjlaro.pif

pid process

584 cjlaro.pif

pid	process
584	cjlaro.pif

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.execjlaro.pif

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe"	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	cjlaro.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\77066510\\cjlaro.pif C:\\Users\\Admin\\77066510\\txoxpdjc.qnr"	cjlaro.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\77066510\\Update.vbs"	cjlaro.pif

Suspicious use of SetThreadContext 1 IoCs

Processes:

cjlaro.pif

description pid process target process

PID 584 set thread context of 68 584 cjlaro.pif RegSvcs.exe

description	pid	process	target process
PID 584 set thread context of 68	584	cjlaro.pif	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Program Files (x86)\SCSI Service\scsisvc.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\SCSI Service\scsisvc.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3960 schtasks.exe
1128 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

RegSvcs.exe

pid process

68 RegSvcs.exe
68 RegSvcs.exe
68 RegSvcs.exe
68 RegSvcs.exe
68 RegSvcs.exe
68 RegSvcs.exe
68 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

68 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 68 RegSvcs.exe
Token: SeDebugPrivilege 68 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cjlaro.pif

pid process

584 cjlaro.pif

pid	process
3960	schtasks.exe
1128	schtasks.exe

pid	process
68	RegSvcs.exe
68	RegSvcs.exe
68	RegSvcs.exe
68	RegSvcs.exe
68	RegSvcs.exe
68	RegSvcs.exe
68	RegSvcs.exe

pid	process
68	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	68	RegSvcs.exe
Token: SeDebugPrivilege	68	RegSvcs.exe

pid	process
584	cjlaro.pif

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9a4a8643db95a8c0fe52af8675a5d1b1.execjlaro.pifRegSvcs.exe

description	pid	process	target process
PID 2352 wrote to memory of 584	2352	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 2352 wrote to memory of 584	2352	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 2352 wrote to memory of 584	2352	9a4a8643db95a8c0fe52af8675a5d1b1.exe	cjlaro.pif
PID 584 wrote to memory of 68	584	cjlaro.pif	RegSvcs.exe
PID 584 wrote to memory of 68	584	cjlaro.pif	RegSvcs.exe
PID 584 wrote to memory of 68	584	cjlaro.pif	RegSvcs.exe
PID 584 wrote to memory of 68	584	cjlaro.pif	RegSvcs.exe
PID 584 wrote to memory of 68	584	cjlaro.pif	RegSvcs.exe
PID 68 wrote to memory of 3960	68	RegSvcs.exe	schtasks.exe
PID 68 wrote to memory of 3960	68	RegSvcs.exe	schtasks.exe
PID 68 wrote to memory of 3960	68	RegSvcs.exe	schtasks.exe
PID 68 wrote to memory of 1128	68	RegSvcs.exe	schtasks.exe
PID 68 wrote to memory of 1128	68	RegSvcs.exe	schtasks.exe
PID 68 wrote to memory of 1128	68	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\9a4a8643db95a8c0fe52af8675a5d1b1.exe
"C:\Users\Admin\AppData\Local\Temp\9a4a8643db95a8c0fe52af8675a5d1b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\77066510\cjlaro.pif
  "C:\Users\Admin\77066510\cjlaro.pif" txoxpdjc.qnr
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:68
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD591.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3960
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "SCSI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD69B.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
C:\Users\Admin\77066510\cjlaro.pif

MD5
279dae7236f5f2488a4bacde6027f730

SHA1
29a012e5259739f24480cedfd6d5f2d860cfcdb3

SHA256
415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f

SHA512
b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8

Download Submit
C:\Users\Admin\77066510\hrennftnds.cpl

MD5
51b278bb20ba6b5c39b96e40b19a591f

SHA1
ccf1834f98327a25b1404ef9d679b9d8a29d5330

SHA256
b68324e9d8a2669f261b06af1f96da4cd8360cef79f76e2af45ea7e423f96c2d

SHA512
0c7b27f4227069385d57cc4983a40ddf55a782dce47a7bff2a484c1ae92c0c66fcc7804b7ab25ca175939a6f4816b6e769d69229052f01d94e8ee7d8eefc4d91

Download Submit
C:\Users\Admin\77066510\mbchmfnast.lfh

MD5
fe4f919f7fd004d0d1c5c89bcf638d11

SHA1
11af89c8ed4069e553fa20f204d1c8c78c60505f

SHA256
bf5e0a807796017b22886d1c734d579dc22cdd47a2a26560960908bb05baa6b8

SHA512
87cb95067da0e57dea4e853e3bb23ad7df79489a570c0182271461ff7512ba889497a756f6b1df33561bec569ad6d7aa171bb8e2fd7940a21470960c84265b49

Download Submit
C:\Users\Admin\77066510\txoxpdjc.qnr

MD5
a6b5973b2ab8621e18de5325194d4217

SHA1
ae4f38f9d99fe7caa0dfd1a8c20f9a8645c1ad19

SHA256
9f205b1613138a4ceb7942223c7654d575062ecb54d3cf54cdf1bb3e56bc2a6e

SHA512
938cd33cdc47f8bf9e588c9c2d4d9df17c3866d69cd44527f08003cc1f50a96bddde7ad268d4ff3b5cddebaeac44c9a888433172d5747b3ab419283d57414be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD591.tmp

MD5
8cad1b41587ced0f1e74396794f31d58

SHA1
11054bf74fcf5e8e412768035e4dae43aa7b710f

SHA256
3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c

SHA512
99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD69B.tmp

MD5
4e71faa3a77029484cfaba423d96618f

SHA1
9c837d050bb43d69dc608af809c292e13bca4718

SHA256
c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb

SHA512
6d014de41352f2b0b494d94cd58188791e81d4e53578d0722110b6827793b735e19c614877f25c61b26233dea1b5f1998ba1240bdc8fa04c87b7e64a4ca15fe0

Download Submit
memory/68-127-0x0000000005F50000-0x0000000005F51000-memory.dmp

Filesize
4KB

Download
memory/68-122-0x000000000111E792-mapping.dmp

Download
memory/68-126-0x0000000005E10000-0x0000000005E11000-memory.dmp

Filesize
4KB

Download
memory/68-138-0x0000000005D30000-0x000000000622E000-memory.dmp

Filesize
5.0MB

Download
memory/68-128-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Filesize
4KB

Download
memory/68-137-0x0000000006F30000-0x0000000006F33000-memory.dmp

Filesize
12KB

Download
memory/68-130-0x0000000005D30000-0x000000000622E000-memory.dmp

Filesize
5.0MB

Download
memory/68-125-0x0000000006230000-0x0000000006231000-memory.dmp

Filesize
4KB

Download
memory/68-136-0x0000000006130000-0x0000000006149000-memory.dmp

Filesize
100KB

Download
memory/68-121-0x0000000001100000-0x00000000017ED000-memory.dmp

Filesize
6.9MB

Download
memory/68-134-0x0000000005F10000-0x0000000005F15000-memory.dmp

Filesize
20KB

Download
memory/68-135-0x0000000005F20000-0x0000000005F26000-memory.dmp

Filesize
24KB

Download
memory/584-115-0x0000000000000000-mapping.dmp

Download
memory/1128-132-0x0000000000000000-mapping.dmp

Download
memory/3960-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads