nanocore | 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
15/04/2022, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
Size 462KB
Sample220415-a5tmeafaap
SHA256 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01
MD5 48d86934fb781685122dfcdae8e4f256
SHA1 538e07a3422df1b78540849ab02a69097435adf8
SHA512 aacaa639400595e66ed86ed69619eae9c5f22882b1a3119d272f8b9af5f1d03212d800813ba66a09a3fd0bda3dbcd6ef6b14eeceafa9b61c40470525af989c16
MD5 SHA1 SHA512

Score

10^/10

nanocore parallax evasion keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

niiarmah.kozow.com:9301

Mutex

ef42b77b-c8cc-45cb-b0b4-e774d77e37ba

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-08-21T18:37:07.916019536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9301
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
ef42b77b-c8cc-45cb-b0b4-e774d77e37ba
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
niiarmah.kozow.com
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Executes dropped EXE 1 IoCs

pid	Process
3628	svhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1716	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Security\Updates.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
3628	svhost.exe
3628	svhost.exe
3628	svhost.exe
1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3628	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
Token: SeDebugPrivilege	3628	svhost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 3628	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	82
PID 1356 wrote to memory of 2004	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	83
PID 1356 wrote to memory of 2004	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	83
PID 1356 wrote to memory of 2004	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	83
PID 1356 wrote to memory of 4612	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	85
PID 1356 wrote to memory of 4612	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	85
PID 1356 wrote to memory of 4612	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	85
PID 4612 wrote to memory of 2344	4612	cmd.exe	87
PID 4612 wrote to memory of 2344	4612	cmd.exe	87
PID 4612 wrote to memory of 2344	4612	cmd.exe	87
PID 1356 wrote to memory of 2580	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	88
PID 1356 wrote to memory of 2580	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	88
PID 1356 wrote to memory of 2580	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	88
PID 1356 wrote to memory of 4684	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	90
PID 1356 wrote to memory of 4684	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	90
PID 1356 wrote to memory of 4684	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	90
PID 1356 wrote to memory of 876	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	92
PID 1356 wrote to memory of 876	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	92
PID 1356 wrote to memory of 876	1356	6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe	92
PID 876 wrote to memory of 1716	876	cmd.exe	94
PID 876 wrote to memory of 1716	876	cmd.exe	94
PID 876 wrote to memory of 1716	876	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe
"C:\Users\Admin\AppData\Local\Temp\6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01.exe" "%appdata%\Security\Updates.exe" /Y
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Security\Updates.exe.lnk" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\Updates.exe.lnk" /f
    3⤵
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Security\Updates.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:2580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Security\Updates.exe.jpg" Updates.exe
  2⤵
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Security\Updates.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updates.exe

Path C:\Users\Admin\AppData\Roaming\Security\Updates.exe
Size 462KB
SHA256 6f6a956472613361087e326a732044349891e4ebaff99b2278836389cabdec01
MD5 48d86934fb781685122dfcdae8e4f256
SHA1 538e07a3422df1b78540849ab02a69097435adf8
SHA512 aacaa639400595e66ed86ed69619eae9c5f22882b1a3119d272f8b9af5f1d03212d800813ba66a09a3fd0bda3dbcd6ef6b14eeceafa9b61c40470525af989c16
SSDEEP 6144:mXoCXxRXFu0yE62GK5lBM1d9fT0eZzpGUcxhhOjl5WLayUsT6LUjWT/spzu+WAPU:ZcHoR2J5RUcZqWUWJJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updates.exe.bat

Path C:\Users\Admin\AppData\Roaming\Security\Updates.exe.bat
Size 205B
SHA256 fa4f71efddbbc88768574504f59ca283911cb40cc0ca52185e782436342945a8
MD5 89c271e144581e0e00347269b020a002
SHA1 ad9fe3d0aaf5579f17004982aa1ea53afee6d0d2
SHA512 ea099eaf12aa74947171f861af1ee2223178942c722b08e45158dfb85c32fe6f38d61b5f5fea86223b5faede58f32cb6d0661cbdc9a29b78918e9b057bde1ed1
MD5 SHA1 SHA512

Submit Download

memory/1356-134-0x0000000000EE0000-0x0000000000F5A000-memory.dmp

Download

memory/1356-135-0x00000000058F0000-0x000000000598C000-memory.dmp

Download

memory/3628-143-0x0000000004B70000-0x0000000004B7A000-memory.dmp

Download

memory/3628-142-0x0000000004BB0000-0x0000000004C42000-memory.dmp

Download

memory/3628-141-0x0000000005160000-0x0000000005704000-memory.dmp

Download

memory/3628-140-0x0000000000390000-0x00000000003C8000-memory.dmp

Download