nanocore | 1d092622ba8620d14d7432d9eeb437f68e35ac81ffcc9732d8664e4ff501eb0c

Analysis

max time kernel
148s
max time network
193s
platform
windows7_x64
resource
win7-en-20210920
submitted
20-10-2021 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PROFORMA INVOICE20211018.xlxs.exe
Size

760KB
MD5

3ec71d8b38605e11dfae1893bf96442a
SHA1

9f9a1e1a7cc646edb4be2dc133e9649b8443e842
SHA256

ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093
SHA512

fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Score

10^/10

nanocore agilenet evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

185.19.85.137:7020

Mutex

88b0125e-e46f-4954-ad2f-4e6855c94d7d

Attributes

activate_away_mode
true
backup_connection_host
185.19.85.137
backup_dns_server
buffer_size
65535
build_time
2021-07-24T03:28:09.410240436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
7020
default_group
NEW FILE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
88b0125e-e46f-4954-ad2f-4e6855c94d7d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.19.85.137
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

A.exeInstallUtil.exe

pid process

896 A.exe
1276 InstallUtil.exe
Loads dropped DLL 3 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.exeA.exe

pid process

1212 PROFORMA INVOICE20211018.xlxs.exe
1212 PROFORMA INVOICE20211018.xlxs.exe
896 A.exe

pid	process
896	A.exe
1276	InstallUtil.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1212-56-0x0000000000910000-0x0000000000931000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exeInstallUtil.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\A = "C:\\Users\\Admin\\AppData\\Roaming\\A.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe"	InstallUtil.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

InstallUtil.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallUtil.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

A.exe

description pid process target process

PID 896 set thread context of 1276 896 A.exe InstallUtil.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	InstallUtil.exe

description	pid	process	target process
PID 896 set thread context of 1276	896	A.exe	InstallUtil.exe

Drops file in Program Files directory 2 IoCs

Processes:

InstallUtil.exe

description	ioc	process
File created	C:\Program Files (x86)\UDP Subsystem\udpss.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\UDP Subsystem\udpss.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1940 schtasks.exe
1656 schtasks.exe

pid	process
1940	schtasks.exe
1656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.exeA.exeInstallUtil.exe

pid	process
1212	PROFORMA INVOICE20211018.xlxs.exe
1212	PROFORMA INVOICE20211018.xlxs.exe
1212	PROFORMA INVOICE20211018.xlxs.exe
1212	PROFORMA INVOICE20211018.xlxs.exe
896	A.exe
896	A.exe
1276	InstallUtil.exe
1276	InstallUtil.exe
1276	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

1276 InstallUtil.exe

pid	process
1276	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.exeA.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1212	PROFORMA INVOICE20211018.xlxs.exe
Token: SeDebugPrivilege	896	A.exe
Token: SeDebugPrivilege	1276	InstallUtil.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.execmd.exeA.exeInstallUtil.exe

description	pid	process	target process
PID 1212 wrote to memory of 760	1212	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 1212 wrote to memory of 760	1212	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 1212 wrote to memory of 760	1212	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 1212 wrote to memory of 760	1212	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 760 wrote to memory of 240	760	cmd.exe	reg.exe
PID 760 wrote to memory of 240	760	cmd.exe	reg.exe
PID 760 wrote to memory of 240	760	cmd.exe	reg.exe
PID 760 wrote to memory of 240	760	cmd.exe	reg.exe
PID 1212 wrote to memory of 896	1212	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 1212 wrote to memory of 896	1212	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 1212 wrote to memory of 896	1212	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 1212 wrote to memory of 896	1212	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 896 wrote to memory of 1276	896	A.exe	InstallUtil.exe
PID 1276 wrote to memory of 1940	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1940	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1940	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1940	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1656	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1656	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1656	1276	InstallUtil.exe	schtasks.exe
PID 1276 wrote to memory of 1656	1276	InstallUtil.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE20211018.xlxs.exe
"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE20211018.xlxs.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "A" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "A" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A.exe"
3⤵
- Adds Run key to start application
PID:240

C:\Users\Admin\AppData\Roaming\A.exe
"C:\Users\Admin\AppData\Roaming\A.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD430.tmp"
4⤵
- Creates scheduled task(s)
PID:1940

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD55A.tmp"
4⤵
- Creates scheduled task(s)
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD430.tmp
MD5
f7eb19c49b51cdff67a25c6876a78241

SHA1
6d86be501c2fb57b50292a55d3983b7eee8a688d

SHA256
c9dab73a0044021d2acbc3952b19dea98cdfd838afc633197bd1bd12d2562fba

SHA512
1e94e363f9d4d0dcdfe0a8457642fcfe4f81dff0b39f1d1f00deab9291e133cd40b48c097dfe52c356d4a15c383e0aa08fae28b136937bcc57d5e01861716740

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD55A.tmp
MD5
c4aecdef99eba873119e79616df3f4b0

SHA1
b1b3af52655fb633eed909dfed05b64fbbfac37c

SHA256
24fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b

SHA512
e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4

Download Submit
C:\Users\Admin\AppData\Roaming\A.exe
MD5
3ec71d8b38605e11dfae1893bf96442a

SHA1
9f9a1e1a7cc646edb4be2dc133e9649b8443e842

SHA256
ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093

SHA512
fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Download Submit
C:\Users\Admin\AppData\Roaming\A.exe
MD5
3ec71d8b38605e11dfae1893bf96442a

SHA1
9f9a1e1a7cc646edb4be2dc133e9649b8443e842

SHA256
ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093

SHA512
fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
\Users\Admin\AppData\Roaming\A.exe
MD5
3ec71d8b38605e11dfae1893bf96442a

SHA1
9f9a1e1a7cc646edb4be2dc133e9649b8443e842

SHA256
ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093

SHA512
fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Download Submit
\Users\Admin\AppData\Roaming\A.exe
MD5
3ec71d8b38605e11dfae1893bf96442a

SHA1
9f9a1e1a7cc646edb4be2dc133e9649b8443e842

SHA256
ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093

SHA512
fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Download Submit
memory/240-58-0x0000000000000000-mapping.dmp

Download
memory/760-57-0x0000000000000000-mapping.dmp

Download
memory/896-62-0x0000000000000000-mapping.dmp

Download
memory/896-65-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/896-67-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/896-69-0x0000000004AD1000-0x0000000004AD2000-memory.dmp

Filesize
4KB

Download
memory/896-71-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/896-70-0x0000000002160000-0x000000000216B000-memory.dmp

Filesize
44KB

Download
memory/1212-53-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1212-55-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1212-56-0x0000000000910000-0x0000000000931000-memory.dmp

Filesize
132KB

Download
memory/1212-59-0x0000000004CC1000-0x0000000004CC2000-memory.dmp

Filesize
4KB

Download
memory/1276-77-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1276-78-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1276-79-0x000000000041E792-mapping.dmp

Download
memory/1276-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1276-81-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1276-83-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/1276-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1276-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1276-88-0x0000000000490000-0x0000000000495000-memory.dmp

Filesize
20KB

Download
memory/1276-89-0x0000000000640000-0x0000000000659000-memory.dmp

Filesize
100KB

Download
memory/1276-90-0x0000000000660000-0x0000000000663000-memory.dmp

Filesize
12KB

Download
memory/1656-86-0x0000000000000000-mapping.dmp

Download
memory/1940-84-0x0000000000000000-mapping.dmp

Download