nanocore | 435d0e10242410c1f8513df632eac9966534480a2a211fdc2914ad9181b87007

General

Target

d100485ad14f8463450278591b10c698.exe
Size

354KB
MD5

d100485ad14f8463450278591b10c698
SHA1

cc6d2bf8405f818be1c3b6bcabd845120d694fc4
SHA256

435d0e10242410c1f8513df632eac9966534480a2a211fdc2914ad9181b87007
SHA512

2ce2b63b1cc05863a0d9908b0f392c14698ef0cdbd8ac0ba68c4b645af30b430239c9735f509cffff7b3951b28dec6bf34c0abb4c63c17212c9895668646d338

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

azizurfattahtradings.duckdns.org:5051

79.134.225.113:5051

Mutex

7a64f481-657b-4816-ad8f-12f7fa667bd3

Attributes

activate_away_mode
true
backup_connection_host
79.134.225.113
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-07-23T14:03:19.830114636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5051
default_group
DUCK BILLIONAIRE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7a64f481-657b-4816-ad8f-12f7fa667bd3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
azizurfattahtradings.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d100485ad14f8463450278591b10c698.exeaspnet_compiler.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\systemm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d100485ad14f8463450278591b10c698.exe"	d100485ad14f8463450278591b10c698.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe"	aspnet_compiler.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d100485ad14f8463450278591b10c698.exe

description pid process target process

PID 2404 set thread context of 2912 2404 d100485ad14f8463450278591b10c698.exe aspnet_compiler.exe

description	pid	process	target process
PID 2404 set thread context of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe

Drops file in Program Files directory 2 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
File created	C:\Program Files (x86)\SCSI Service\scsisvc.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\SCSI Service\scsisvc.exe	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

aspnet_compiler.exe

pid process

2912 aspnet_compiler.exe
2912 aspnet_compiler.exe
2912 aspnet_compiler.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aspnet_compiler.exe

pid process

2912 aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 2912 aspnet_compiler.exe

pid	process
2912	aspnet_compiler.exe
2912	aspnet_compiler.exe
2912	aspnet_compiler.exe

pid	process
2912	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	2912	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d100485ad14f8463450278591b10c698.exe

description	pid	process	target process
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe
PID 2404 wrote to memory of 2912	2404	d100485ad14f8463450278591b10c698.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\d100485ad14f8463450278591b10c698.exe
"C:\Users\Admin\AppData\Local\Temp\d100485ad14f8463450278591b10c698.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-115-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2404-117-0x00000000011B0000-0x00000000011E7000-memory.dmp

Filesize
220KB

Download
memory/2404-118-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/2404-119-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/2404-120-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/2912-121-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2912-122-0x000000000041E792-mapping.dmp

Download
memory/2912-126-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/2912-128-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/2912-129-0x0000000004F80000-0x0000000004F85000-memory.dmp

Filesize
20KB

Download
memory/2912-130-0x00000000050F0000-0x0000000005109000-memory.dmp

Filesize
100KB

Download
memory/2912-131-0x0000000005BB0000-0x0000000005BB3000-memory.dmp

Filesize
12KB

Download
memory/2912-132-0x0000000004EF0000-0x00000000053EE000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads