nanocore | 8948abf5e6d357805d72b6d05015e70c705e2a7bbd58704d63fcdb1a9b2116dd

General

Target

H1GC5Z4C39PAYMENTRECEIPT.exe
Size

1.7MB
MD5

33c1ebab9ea309a6c217404373190bea
SHA1

8349bdbc19687cf3baf7167562fc7e5febc0b088
SHA256

8948abf5e6d357805d72b6d05015e70c705e2a7bbd58704d63fcdb1a9b2116dd
SHA512

44817a63c1b2a4943683c19b2a9e22641a2a364a1ed1436e0d3561450b9c549b78964d61c813fc85635dfc599f7f27f42704bb548d0ddb288ec4c952d543bbc3

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

kenimaf.duckdns.org:8090

Mutex

543e7469-d950-4ec2-a110-de54f8d16167

Attributes

activate_away_mode
true
backup_connection_host
kenimaf.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-08-01T06:39:50.225932136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8090
default_group
kenn
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
543e7469-d950-4ec2-a110-de54f8d16167
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
kenimaf.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	H1GC5Z4C39PAYMENTRECEIPT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\㟋㟙㟉㞻㟊㞞㟈㞳㟊㞞㞖㟇㞙㟟㞰\svchost.exe = "0"	H1GC5Z4C39PAYMENTRECEIPT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\H1GC5Z4C39PAYMENTRECEIPT.exe = "0"	H1GC5Z4C39PAYMENTRECEIPT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	H1GC5Z4C39PAYMENTRECEIPT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\롈롉렞렚롚렕롎롏롈롈롉롗롇렕렖 = "C:\\Program Files\\Common Files\\System\\㟋㟙㟉㞻㟊㞞㟈㞳㟊㞞㞖㟇㞙㟟㞰\\svchost.exe"	H1GC5Z4C39PAYMENTRECEIPT.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	H1GC5Z4C39PAYMENTRECEIPT.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

pid	process
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

description pid process target process

PID 1756 set thread context of 1664 1756 H1GC5Z4C39PAYMENTRECEIPT.exe H1GC5Z4C39PAYMENTRECEIPT.exe

description	pid	process	target process
PID 1756 set thread context of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe

Drops file in Program Files directory 2 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\㟋㟙㟉㞻㟊㞞㟈㞳㟊㞞㞖㟇㞙㟟㞰\svchost.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
File opened for modification	C:\Program Files\Common Files\System\㟋㟙㟉㞻㟊㞞㟈㞳㟊㞞㞖㟇㞙㟟㞰\svchost.exe	H1GC5Z4C39PAYMENTRECEIPT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exepowershell.exepowershell.exeH1GC5Z4C39PAYMENTRECEIPT.exe

pid	process
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1756	H1GC5Z4C39PAYMENTRECEIPT.exe
1740	powershell.exe
1648	powershell.exe
1664	H1GC5Z4C39PAYMENTRECEIPT.exe
1664	H1GC5Z4C39PAYMENTRECEIPT.exe
1664	H1GC5Z4C39PAYMENTRECEIPT.exe
1664	H1GC5Z4C39PAYMENTRECEIPT.exe
1664	H1GC5Z4C39PAYMENTRECEIPT.exe
1664	H1GC5Z4C39PAYMENTRECEIPT.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

pid process

1664 H1GC5Z4C39PAYMENTRECEIPT.exe

pid	process
1664	H1GC5Z4C39PAYMENTRECEIPT.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exepowershell.exepowershell.exeH1GC5Z4C39PAYMENTRECEIPT.exe

description	pid	process
Token: SeDebugPrivilege	1756	H1GC5Z4C39PAYMENTRECEIPT.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	1664	H1GC5Z4C39PAYMENTRECEIPT.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

H1GC5Z4C39PAYMENTRECEIPT.exe

description	pid	process	target process
PID 1756 wrote to memory of 1740	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1740	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1740	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1740	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1528	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1528	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1528	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1528	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1648	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1648	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1648	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1648	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	powershell.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe
PID 1756 wrote to memory of 1664	1756	H1GC5Z4C39PAYMENTRECEIPT.exe	H1GC5Z4C39PAYMENTRECEIPT.exe

C:\Users\Admin\AppData\Local\Temp\H1GC5Z4C39PAYMENTRECEIPT.exe
"C:\Users\Admin\AppData\Local\Temp\H1GC5Z4C39PAYMENTRECEIPT.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\㟋㟙㟉㞻㟊㞞㟈㞳㟊㞞㞖㟇㞙㟟㞰\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\H1GC5Z4C39PAYMENTRECEIPT.exe" -Force
2⤵
PID:1528

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\㟋㟙㟉㞻㟊㞞㟈㞳㟊㞞㞖㟇㞙㟟㞰\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Users\Admin\AppData\Local\Temp\H1GC5Z4C39PAYMENTRECEIPT.exe
"C:\Users\Admin\AppData\Local\Temp\H1GC5Z4C39PAYMENTRECEIPT.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
df613a71cbf53b2d144347b5e024e532

SHA1
d316fd1de93b39bfe5b0fa7e497fde537a106a87

SHA256
7e762ba8f556be213538f80e74e5788e519ec470e783e6d00e4fb8def6845ae7

SHA512
f9a84c54b472b42342b39e8fa52fb7ba9fe32f8920b967ee27c4e7c90ab911415c02d10676c0f218ed9bd9a7866ca8d6192619fc9b3d6daab0fdd9fac23e8981

Download Submit
memory/1528-61-0x0000000000000000-mapping.dmp

Download
memory/1648-72-0x00000000024C0000-0x000000000310A000-memory.dmp

Filesize
12.3MB

Download
memory/1648-62-0x0000000000000000-mapping.dmp

Download
memory/1648-76-0x00000000024C0000-0x000000000310A000-memory.dmp

Filesize
12.3MB

Download
memory/1648-128-0x00000000024C0000-0x000000000310A000-memory.dmp

Filesize
12.3MB

Download
memory/1664-67-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1664-71-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1664-75-0x000000000041E792-mapping.dmp

Download
memory/1664-69-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1664-134-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/1664-68-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1664-83-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1664-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1740-60-0x0000000000000000-mapping.dmp

Download
memory/1740-70-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/1740-126-0x0000000001D72000-0x0000000001D74000-memory.dmp

Filesize
8KB

Download
memory/1740-74-0x0000000001D71000-0x0000000001D72000-memory.dmp

Filesize
4KB

Download
memory/1756-59-0x00000000009C0000-0x0000000000A4F000-memory.dmp

Filesize
572KB

Download
memory/1756-54-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/1756-77-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1756-58-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/1756-56-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1756-57-0x0000000000380000-0x0000000000383000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads