nanocore

General

Target

POfile.xlsx
Size

243KB
Sample

211108-xyssvsdaa4
MD5

cbbff4822ff1b63dee6cc0af1db52d2c
SHA1

7f51d1a77de8dab4abea3cf27fd7fd5b96b9499d
SHA256

8703a6cc8c74cdcbf0161b39c49d9a5574351704c200d3d609d8896fe04a1232
SHA512

13dc8fe3338285c9cfe6e1e61f398d04ed6e2ba552af6fa8c8c2c14e27cdeb8bc787867ac14f2f3bfa6d3a46ee1366e1bfea4b7d7f9d46dcd179178d72b675bc

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

darkworldblackerlocker.dumb1.com:5270

Extracted

Family

xloader

Version

2.5

Campaign

poni

C2

http://www.camimac.com/poni/

Decoy

privateerspacecompany.space

underwatergirlart.com

findphotographersonline.com

xperthardware.com

skydeksolutions.com

pet-regi.net

stoltenbergbethelpark.com

kruithofkenter.com

kryptocoaching.com

glenndcp.com

greaterhealthyliving.com

vfjofr.com

rbtos.com

eyxzlr.xyz

cdhczs.com

011atk.xyz

homemasterpro.store

equipesaudeimporta.online

baskaty.com

mindstone.gmbh

Extracted

Family

nanocore

Version

1.2.2.0

C2

lockerrollercooller.mywire.org:54941

127.0.0.1:54941

Mutex

968b64dd-a1e5-4192-b7da-7c0a1f44cca5

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-08-10T00:29:28.268699536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54941
default_group
Runner-R
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
968b64dd-a1e5-4192-b7da-7c0a1f44cca5
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
lockerrollercooller.mywire.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  POfile.xlsx
- Size
  
  243KB
- MD5
  
  cbbff4822ff1b63dee6cc0af1db52d2c
- SHA1
  
  7f51d1a77de8dab4abea3cf27fd7fd5b96b9499d
- SHA256
  
  8703a6cc8c74cdcbf0161b39c49d9a5574351704c200d3d609d8896fe04a1232
- SHA512
  
  13dc8fe3338285c9cfe6e1e61f398d04ed6e2ba552af6fa8c8c2c14e27cdeb8bc787867ac14f2f3bfa6d3a46ee1366e1bfea4b7d7f9d46dcd179178d72b675bc
Score

10^/10

nanocore warzonerat xloader xmrig poni agilenet evasion infostealer keylogger loader miner persistence rat spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Warzone RAT Payload
  rat
- Xloader Payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Uses the VBS compiler for execution
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2