nanocore | 7d099dcd6d912e29120d1eca72f100724fa776e8a1f80b22fbb52e6de905d324

General

Target
bd8f7a95d63891f57462cfa5b2179888.exe
Size 973KB
Sample211014-srbhsaagaj
SHA256 7d099dcd6d912e29120d1eca72f100724fa776e8a1f80b22fbb52e6de905d324
MD5 bd8f7a95d63891f57462cfa5b2179888
SHA1 66839ede4459f5df3c228221ef563f6fdfef5db3
SHA512 9bc81d9fe1c39b9ce8301d68eebac20ff78a4c6886f01a9c8541561333e29b3e6f721101c490ff4262abe295f8f940aefad5f54cf62ef3d93448132e2b1606b5
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

strongodss.ddns.net:48562
185.19.85.175:48562

Mutex

ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2021-04-20T00:12:13.961451136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
48562
default_group
HOBBIT
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
strongodss.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
852	woag.pif
1648	RegSvcs.exe

Loads dropped DLL 5 IoCs

pid	Process
1368	bd8f7a95d63891f57462cfa5b2179888.exe
1368	bd8f7a95d63891f57462cfa5b2179888.exe
1368	bd8f7a95d63891f57462cfa5b2179888.exe
1368	bd8f7a95d63891f57462cfa5b2179888.exe
852	woag.pif

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	woag.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "c:\\69392457\\woag.pif c:\\69392457\\tidhtdr.iun"	woag.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "c:\\69392457\\Update.vbs"	woag.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 852 set thread context of 1648	852	woag.pif	28

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\UDP Subsystem\udpss.exe	RegSvcs.exe
File created	C:\Program Files (x86)\UDP Subsystem\udpss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1792	schtasks.exe
1812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1648	RegSvcs.exe
1648	RegSvcs.exe
1648	RegSvcs.exe
1648	RegSvcs.exe
1648	RegSvcs.exe
1648	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1648	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	RegSvcs.exe
Token: SeDebugPrivilege	1648	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 852	1368	bd8f7a95d63891f57462cfa5b2179888.exe	27
PID 1368 wrote to memory of 852	1368	bd8f7a95d63891f57462cfa5b2179888.exe	27
PID 1368 wrote to memory of 852	1368	bd8f7a95d63891f57462cfa5b2179888.exe	27
PID 1368 wrote to memory of 852	1368	bd8f7a95d63891f57462cfa5b2179888.exe	27
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 852 wrote to memory of 1648	852	woag.pif	28
PID 1648 wrote to memory of 1792	1648	RegSvcs.exe	29
PID 1648 wrote to memory of 1792	1648	RegSvcs.exe	29
PID 1648 wrote to memory of 1792	1648	RegSvcs.exe	29
PID 1648 wrote to memory of 1792	1648	RegSvcs.exe	29
PID 1648 wrote to memory of 1812	1648	RegSvcs.exe	31
PID 1648 wrote to memory of 1812	1648	RegSvcs.exe	31
PID 1648 wrote to memory of 1812	1648	RegSvcs.exe	31
PID 1648 wrote to memory of 1812	1648	RegSvcs.exe	31

C:\Users\Admin\AppData\Local\Temp\bd8f7a95d63891f57462cfa5b2179888.exe
"C:\Users\Admin\AppData\Local\Temp\bd8f7a95d63891f57462cfa5b2179888.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368
- C:\69392457\woag.pif
  "C:\69392457\woag.pif" tidhtdr.iun
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp274F.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1792
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2CBC.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-53-0x00000000768C1000-0x00000000768C3000-memory.dmp

Download

memory/1648-66-0x0000000000390000-0x0000000000A45000-memory.dmp

Download

memory/1648-70-0x0000000000390000-0x0000000000A45000-memory.dmp

Download

memory/1648-72-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/1648-65-0x0000000000390000-0x0000000000A45000-memory.dmp

Download

memory/1648-77-0x0000000000B80000-0x0000000000B85000-memory.dmp

Download

memory/1648-78-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/1648-79-0x0000000000D60000-0x0000000000D79000-memory.dmp

Download

memory/1648-80-0x0000000000D80000-0x0000000000D83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads