nanocore | 7709c1a46eff201524b42caaecba9ce963f7580e77d7b9c32059aaf3acfb248a

General

Target
urgent purchase order.exe
Size 783KB
Sample220502-tf7mhshae4
SHA256 7709c1a46eff201524b42caaecba9ce963f7580e77d7b9c32059aaf3acfb248a
MD5 49a768bcb661c8e73ebc6b96eefcb1f8
SHA1 886e9207c6aa0eca8914b5425ded854a2ef2a7df
SHA512 ff34e4271eb3b4b7d2a5981445af5353600e09fcb4afd2fa1c56a9062cc35531c6196ca0f9033dc869bac63c19b71da200a1ade9c7f9c13c921ad10b6b9ec541
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

papakamzy.ddns.net:7600
104.144.69.135:7600

Mutex

693b0d11-68b2-4e93-b1c8-b61432b219e1

Attributes

activate_away_mode
true
backup_connection_host
104.144.69.135
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-02-09T21:22:32.590785336Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7600
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
693b0d11-68b2-4e93-b1c8-b61432b219e1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
papakamzy.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 4296	1560	urgent purchase order.exe	93

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93
PID 1560 wrote to memory of 4296	1560	urgent purchase order.exe	93

C:\Users\Admin\AppData\Local\Temp\urgent purchase order.exe
"C:\Users\Admin\AppData\Local\Temp\urgent purchase order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\urgent purchase order.exe
  "C:\Users\Admin\AppData\Local\Temp\urgent purchase order.exe"
  2⤵
  PID:4296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

urgent purchase order.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\urgent purchase order.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/1560-130-0x00000000007D0000-0x000000000089A000-memory.dmp

Download

memory/1560-131-0x0000000005A90000-0x0000000006034000-memory.dmp

Download

memory/1560-132-0x00000000054E0000-0x0000000005572000-memory.dmp

Download

memory/1560-133-0x00000000054C0000-0x00000000054CA000-memory.dmp

Download

memory/1560-134-0x00000000075E0000-0x000000000767C000-memory.dmp

Download

memory/1560-135-0x0000000001280000-0x00000000012E6000-memory.dmp

Download

memory/4296-137-0x0000000000400000-0x0000000000438000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads