nanocore | eae81605341641ad10c18ab60b79339617f0219abaa1ab5ee7883fc9d429b885

General

Target

7632JUST.js
Size

1019B
MD5

990c7925b1524993c8764a3959778d0d
SHA1

dbda43ac090d07afa75a2f6cae79be0371983d5a
SHA256

eae81605341641ad10c18ab60b79339617f0219abaa1ab5ee7883fc9d429b885
SHA512

9a31fa5f8eac4071a6752b25038d33d9137010115f77abcac1b80de59c20c346b3680c9dd619d516fd50f39b1777eaead1a599c9087bf7e60e6af9e9c7cbe19d

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

justinalwhitedd554.duckdns.org:7632

Mutex

491b351b-e573-4508-bb4f-0fc9eb37df7b

Attributes

activate_away_mode
true
backup_connection_host
justinalwhitedd554.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-07-21T05:46:17.377036536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7632
default_group
7632Money
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
491b351b-e573-4508-bb4f-0fc9eb37df7b
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
justinalwhitedd554.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

6 3040 wscript.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

7632JUST.exe

pid process

1264 7632JUST.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

7632JUST.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7632JUST.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

7632JUST.exe

pid process

1264 7632JUST.exe
1264 7632JUST.exe
1264 7632JUST.exe
1264 7632JUST.exe
1264 7632JUST.exe
1264 7632JUST.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7632JUST.exe

pid process

1264 7632JUST.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7632JUST.exe

description pid process

Token: SeDebugPrivilege 1264 7632JUST.exe

flow	pid	process
6	3040	wscript.exe

pid	process
1264	7632JUST.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7632JUST.exe

pid	process
1264	7632JUST.exe
1264	7632JUST.exe
1264	7632JUST.exe
1264	7632JUST.exe
1264	7632JUST.exe
1264	7632JUST.exe

pid	process
1264	7632JUST.exe

description	pid	process
Token: SeDebugPrivilege	1264	7632JUST.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3040 wrote to memory of 1264	3040	wscript.exe	7632JUST.exe
PID 3040 wrote to memory of 1264	3040	wscript.exe	7632JUST.exe
PID 3040 wrote to memory of 1264	3040	wscript.exe	7632JUST.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7632JUST.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Roaming\7632JUST.exe
  "C:\Users\Admin\AppData\Roaming\7632JUST.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7632JUST.exe

MD5
00d8921a30d82b0b25d66fd146839f77

SHA1
b6cf72aeb65430bc75cdabfb8798897462881d83

SHA256
2605a1cb2b510612119fdb0e62b543d035ad4f3c873d0f5a7aa3291968c50bc8

SHA512
812bc35c87a440645525e78ca27badd9c125b61548820c6a9d095fb4c3e9b26eea18edce6078e6c9d231ec360dde064d09fac78abeff4942399c27631cf22ef5

Download Submit
C:\Users\Admin\AppData\Roaming\7632JUST.exe

MD5
00d8921a30d82b0b25d66fd146839f77

SHA1
b6cf72aeb65430bc75cdabfb8798897462881d83

SHA256
2605a1cb2b510612119fdb0e62b543d035ad4f3c873d0f5a7aa3291968c50bc8

SHA512
812bc35c87a440645525e78ca27badd9c125b61548820c6a9d095fb4c3e9b26eea18edce6078e6c9d231ec360dde064d09fac78abeff4942399c27631cf22ef5

Download Submit
memory/1264-115-0x0000000000000000-mapping.dmp

Download
memory/1264-118-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing