nanocore | 12b9d16dc98af934b38e22cf08b7c10cb55bfd8bbb3084dcf5699eb0ab35a073

General

Target

31578_Invoice_receipt.exe
Size

763KB
MD5

182b6a3b80b6290f55b6670edf9efd0e
SHA1

f6e60d4d0be6547af5822760bc0c0195884b012d
SHA256

12b9d16dc98af934b38e22cf08b7c10cb55bfd8bbb3084dcf5699eb0ab35a073
SHA512

1aebfcb9df20cc07c3bff03e1294fe479910bfb9b169e1aa895702f9210f19e4993470b5bf08c1181952facca3ad8689031361abe7768d57515c50d31607407a

Score

10^/10

nanocore evasion keylogger persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

sunnysept.duckdns.org:5500

Mutex

af905a54-91e0-44a6-90a1-2d1125da804b

Attributes

activate_away_mode
true
backup_connection_host
sunnysept.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-06-21T21:09:02.390615436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5500
default_group
septe123
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
af905a54-91e0-44a6-90a1-2d1125da804b
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
sunnysept.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

31578_Invoice_receipt.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	31578_Invoice_receipt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	31578_Invoice_receipt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\鑮鑙鑠鐪鑙鐧鑂鐰鑘鑙鐯鑜鐪鑋鑘\svchost.exe = "0"	31578_Invoice_receipt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\31578_Invoice_receipt.exe = "0"	31578_Invoice_receipt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

31578_Invoice_receipt.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\碹磺磲磑磩磿碸磨磆碶碼磪碶磧碵 = "C:\\Windows\\Microsoft.NET\\Framework\\鑮鑙鑠鐪鑙鐧鑂鐰鑘鑙鐯鑜鐪鑋鑘\\svchost.exe"	31578_Invoice_receipt.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

31578_Invoice_receipt.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 31578_Invoice_receipt.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	31578_Invoice_receipt.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

Processes:

31578_Invoice_receipt.exe

pid	process
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

31578_Invoice_receipt.exe

description pid process target process

PID 1432 set thread context of 1120 1432 31578_Invoice_receipt.exe 31578_Invoice_receipt.exe

description	pid	process	target process
PID 1432 set thread context of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe

Drops file in Windows directory 2 IoCs

Processes:

31578_Invoice_receipt.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\鑮鑙鑠鐪鑙鐧鑂鐰鑘鑙鐯鑜鐪鑋鑘\svchost.exe	31578_Invoice_receipt.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\鑮鑙鑠鐪鑙鐧鑂鐰鑘鑙鐯鑜鐪鑋鑘\svchost.exe	31578_Invoice_receipt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 1432 WerFault.exe 31578_Invoice_receipt.exe

pid	pid_target	process	target process
1664	1432	WerFault.exe	31578_Invoice_receipt.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

31578_Invoice_receipt.exeWerFault.exe31578_Invoice_receipt.exepowershell.exepowershell.exepowershell.exe

pid	process
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1432	31578_Invoice_receipt.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe
1168	powershell.exe
564	powershell.exe
1820	powershell.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe
1120	31578_Invoice_receipt.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

31578_Invoice_receipt.exeWerFault.exe

pid process

1120 31578_Invoice_receipt.exe
1664 WerFault.exe

pid	process
1120	31578_Invoice_receipt.exe
1664	WerFault.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

31578_Invoice_receipt.exeWerFault.exe31578_Invoice_receipt.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1432	31578_Invoice_receipt.exe
Token: SeDebugPrivilege	1664	WerFault.exe
Token: SeDebugPrivilege	1120	31578_Invoice_receipt.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

31578_Invoice_receipt.exe

description	pid	process	target process
PID 1432 wrote to memory of 564	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 564	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 564	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 564	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1820	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1820	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1820	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1820	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1168	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1168	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1168	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1168	1432	31578_Invoice_receipt.exe	powershell.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1120	1432	31578_Invoice_receipt.exe	31578_Invoice_receipt.exe
PID 1432 wrote to memory of 1664	1432	31578_Invoice_receipt.exe	WerFault.exe
PID 1432 wrote to memory of 1664	1432	31578_Invoice_receipt.exe	WerFault.exe
PID 1432 wrote to memory of 1664	1432	31578_Invoice_receipt.exe	WerFault.exe
PID 1432 wrote to memory of 1664	1432	31578_Invoice_receipt.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\31578_Invoice_receipt.exe
"C:\Users\Admin\AppData\Local\Temp\31578_Invoice_receipt.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\鑮鑙鑠鐪鑙鐧鑂鐰鑘鑙鐯鑜鐪鑋鑘\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\31578_Invoice_receipt.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\鑮鑙鑠鐪鑙鐧鑂鐰鑘鑙鐯鑜鐪鑋鑘\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Users\Admin\AppData\Local\Temp\31578_Invoice_receipt.exe
"C:\Users\Admin\AppData\Local\Temp\31578_Invoice_receipt.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 1560
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
e1371c80a525f61006d03b3d5de5d79c

SHA1
fd7fdb33f74ee0fdade8cbcb34a622273d3a7e64

SHA256
8a054a23527dff196debe3036a7cb2e54c42632c5fca8da8a7009e5f77c91432

SHA512
7454439508883c6ce96d4fb5ce251310d7d20fd178197cc5f8ad3401f557689ca86df526baa62dd52746aee58177b5240f81593eb70a1b54fd08fce472622a7d

Download Submit
memory/564-84-0x00000000024B2000-0x00000000024B4000-memory.dmp

Filesize
8KB

Download
memory/564-83-0x00000000024B1000-0x00000000024B2000-memory.dmp

Filesize
4KB

Download
memory/564-76-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/564-59-0x0000000000000000-mapping.dmp

Download
memory/1120-86-0x00000000005D0000-0x00000000005E5000-memory.dmp

Filesize
84KB

Download
memory/1120-89-0x0000000000940000-0x0000000000946000-memory.dmp

Filesize
24KB

Download
memory/1120-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1120-66-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1120-67-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1120-69-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1120-68-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1120-70-0x000000000041E792-mapping.dmp

Download
memory/1120-71-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1120-96-0x0000000002180000-0x000000000218F000-memory.dmp

Filesize
60KB

Download
memory/1120-74-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1120-95-0x0000000002110000-0x0000000002139000-memory.dmp

Filesize
164KB

Download
memory/1120-94-0x0000000002070000-0x000000000207A000-memory.dmp

Filesize
40KB

Download
memory/1120-93-0x0000000002060000-0x000000000206F000-memory.dmp

Filesize
60KB

Download
memory/1120-92-0x0000000002050000-0x0000000002059000-memory.dmp

Filesize
36KB

Download
memory/1120-79-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/1120-80-0x00000000002A0000-0x00000000002B9000-memory.dmp

Filesize
100KB

Download
memory/1120-81-0x00000000002C0000-0x00000000002C3000-memory.dmp

Filesize
12KB

Download
memory/1120-91-0x0000000002000000-0x000000000200D000-memory.dmp

Filesize
52KB

Download
memory/1120-90-0x0000000001FF0000-0x0000000001FF7000-memory.dmp

Filesize
28KB

Download
memory/1120-88-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/1120-85-0x00000000003E0000-0x00000000003ED000-memory.dmp

Filesize
52KB

Download
memory/1120-87-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/1168-61-0x0000000000000000-mapping.dmp

Download
memory/1168-77-0x0000000002530000-0x000000000317A000-memory.dmp

Filesize
12.3MB

Download
memory/1432-54-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1432-57-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/1432-56-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/1432-58-0x00000000001D0000-0x0000000000260000-memory.dmp

Filesize
576KB

Download
memory/1664-82-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1664-75-0x0000000000000000-mapping.dmp

Download
memory/1820-78-0x00000000022F0000-0x0000000002F3A000-memory.dmp

Filesize
12.3MB

Download
memory/1820-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads