nanocore | 1d092622ba8620d14d7432d9eeb437f68e35ac81ffcc9732d8664e4ff501eb0c

General

Target

PROFORMA INVOICE20211018.xlxs.exe
Size

760KB
MD5

3ec71d8b38605e11dfae1893bf96442a
SHA1

9f9a1e1a7cc646edb4be2dc133e9649b8443e842
SHA256

ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093
SHA512

fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Score

10^/10

nanocore agilenet evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.19.85.137:7020

Mutex

88b0125e-e46f-4954-ad2f-4e6855c94d7d

Attributes

activate_away_mode
true
backup_connection_host
185.19.85.137
backup_dns_server
buffer_size
65535
build_time
2021-07-24T03:28:09.410240436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
7020
default_group
NEW FILE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
88b0125e-e46f-4954-ad2f-4e6855c94d7d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.19.85.137
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

A.exeInstallUtil.exe

pid process

1016 A.exe
3540 InstallUtil.exe

pid	process
1016	A.exe
3540	InstallUtil.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/1420-120-0x0000000005380000-0x00000000053A1000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exeInstallUtil.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\A = "C:\\Users\\Admin\\AppData\\Roaming\\A.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe"	InstallUtil.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

InstallUtil.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallUtil.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

A.exe

description pid process target process

PID 1016 set thread context of 3540 1016 A.exe InstallUtil.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	InstallUtil.exe

description	pid	process	target process
PID 1016 set thread context of 3540	1016	A.exe	InstallUtil.exe

Drops file in Program Files directory 2 IoCs

Processes:

InstallUtil.exe

description	ioc	process
File created	C:\Program Files (x86)\SMTP Manager\smtpmgr.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\SMTP Manager\smtpmgr.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3720 schtasks.exe
652 schtasks.exe

pid	process
3720	schtasks.exe
652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.exeA.exeInstallUtil.exe

pid	process
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1420	PROFORMA INVOICE20211018.xlxs.exe
1016	A.exe
1016	A.exe
3540	InstallUtil.exe
3540	InstallUtil.exe
3540	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

3540 InstallUtil.exe

pid	process
3540	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.exeA.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1420	PROFORMA INVOICE20211018.xlxs.exe
Token: SeDebugPrivilege	1016	A.exe
Token: SeDebugPrivilege	3540	InstallUtil.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

PROFORMA INVOICE20211018.xlxs.execmd.exeA.exeInstallUtil.exe

description	pid	process	target process
PID 1420 wrote to memory of 2256	1420	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 1420 wrote to memory of 2256	1420	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 1420 wrote to memory of 2256	1420	PROFORMA INVOICE20211018.xlxs.exe	cmd.exe
PID 2256 wrote to memory of 3140	2256	cmd.exe	reg.exe
PID 2256 wrote to memory of 3140	2256	cmd.exe	reg.exe
PID 2256 wrote to memory of 3140	2256	cmd.exe	reg.exe
PID 1420 wrote to memory of 1016	1420	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 1420 wrote to memory of 1016	1420	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 1420 wrote to memory of 1016	1420	PROFORMA INVOICE20211018.xlxs.exe	A.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 1016 wrote to memory of 3540	1016	A.exe	InstallUtil.exe
PID 3540 wrote to memory of 3720	3540	InstallUtil.exe	schtasks.exe
PID 3540 wrote to memory of 3720	3540	InstallUtil.exe	schtasks.exe
PID 3540 wrote to memory of 3720	3540	InstallUtil.exe	schtasks.exe
PID 3540 wrote to memory of 652	3540	InstallUtil.exe	schtasks.exe
PID 3540 wrote to memory of 652	3540	InstallUtil.exe	schtasks.exe
PID 3540 wrote to memory of 652	3540	InstallUtil.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE20211018.xlxs.exe
"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE20211018.xlxs.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "A" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "A" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A.exe"
3⤵
- Adds Run key to start application
PID:3140

C:\Users\Admin\AppData\Roaming\A.exe
"C:\Users\Admin\AppData\Roaming\A.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SMTP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1F1D.tmp"
4⤵
- Creates scheduled task(s)
PID:3720

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SMTP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp20B4.tmp"
4⤵
- Creates scheduled task(s)
PID:652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F1D.tmp
MD5
f7eb19c49b51cdff67a25c6876a78241

SHA1
6d86be501c2fb57b50292a55d3983b7eee8a688d

SHA256
c9dab73a0044021d2acbc3952b19dea98cdfd838afc633197bd1bd12d2562fba

SHA512
1e94e363f9d4d0dcdfe0a8457642fcfe4f81dff0b39f1d1f00deab9291e133cd40b48c097dfe52c356d4a15c383e0aa08fae28b136937bcc57d5e01861716740

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp20B4.tmp
MD5
b3b017f9df206021717a11f11d895402

SHA1
e4ea12823af6550ee634536eec1eb14490580a3b

SHA256
654dfce2c28024364e679e1b958f3fb81fc6d29685d534d905d1c83a84351024

SHA512
95666cb81aa1fd1ade04a32f63381ce8bff274d7d300c0b59cbb10a294c4d1eebaa3000365a2000b38793de030044995cf23e623c5e3648d9b00501f97ff9343

Download Submit
C:\Users\Admin\AppData\Roaming\A.exe
MD5
3ec71d8b38605e11dfae1893bf96442a

SHA1
9f9a1e1a7cc646edb4be2dc133e9649b8443e842

SHA256
ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093

SHA512
fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Download Submit
C:\Users\Admin\AppData\Roaming\A.exe
MD5
3ec71d8b38605e11dfae1893bf96442a

SHA1
9f9a1e1a7cc646edb4be2dc133e9649b8443e842

SHA256
ef5dfc63e13d3e5262051a36bd7eaa218c828274fe27cf5cf1a7ea39a283d093

SHA512
fc91312c82e054c9e9464273853aa37214737d3ac3bd4c1ac922b1acb6516ea5d085ccb1a120199e53ee0b7e1f06dca0f411f6355f8f2d041f67f3d5afca2c70

Download Submit
memory/652-155-0x0000000000000000-mapping.dmp

Download
memory/1016-141-0x0000000007100000-0x0000000007101000-memory.dmp

Filesize
4KB

Download
memory/1016-140-0x00000000070F0000-0x00000000070FB000-memory.dmp

Filesize
44KB

Download
memory/1016-139-0x00000000059E1000-0x00000000059E2000-memory.dmp

Filesize
4KB

Download
memory/1016-134-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/1016-127-0x0000000000000000-mapping.dmp

Download
memory/1420-121-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/1420-126-0x00000000053B1000-0x00000000053B2000-memory.dmp

Filesize
4KB

Download
memory/1420-115-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1420-123-0x0000000005F30000-0x0000000005F31000-memory.dmp

Filesize
4KB

Download
memory/1420-122-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Filesize
4KB

Download
memory/1420-120-0x0000000005380000-0x00000000053A1000-memory.dmp

Filesize
132KB

Download
memory/1420-119-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/1420-118-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1420-117-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2256-124-0x0000000000000000-mapping.dmp

Download
memory/3140-125-0x0000000000000000-mapping.dmp

Download
memory/3540-148-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/3540-151-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/3540-152-0x0000000004E40000-0x000000000533E000-memory.dmp

Filesize
5.0MB

Download
memory/3540-143-0x000000000041E792-mapping.dmp

Download
memory/3540-142-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3540-157-0x0000000004ED0000-0x0000000004ED5000-memory.dmp

Filesize
20KB

Download
memory/3540-158-0x0000000005EB0000-0x0000000005EC9000-memory.dmp

Filesize
100KB

Download
memory/3540-159-0x0000000005FD0000-0x0000000005FD3000-memory.dmp

Filesize
12KB

Download
memory/3720-153-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads