nanocore | e32ddbc4af4d7cdb032b3493f73acd346db0f356befd8029b867860fcaa26e25

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20220414-en
submitted
06/05/2022, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7617294dae18fa4921118522d9ff72b6.exe
Size 558KB
Sample220506-tp8aeachap
SHA256 e32ddbc4af4d7cdb032b3493f73acd346db0f356befd8029b867860fcaa26e25
MD5 7617294dae18fa4921118522d9ff72b6
SHA1 e2ffa4ff386a665a5a6bf912b5d200d3ea2a5e6b
SHA512 757efee366d35151a1814ea80f76ce64f909c6816797504d33880dc086dd6bb6c24b414e42413725afafbde14794379cfc161aa1f9f60c2d7c0de13062719c15
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

surya.ddns.net:50421
185.19.85.175:50421

Mutex

db859f8f-dd41-4cc6-82a2-616a59f8108c

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2022-02-13T19:42:33.329888736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
50421
default_group
0SPEED
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
db859f8f-dd41-4cc6-82a2-616a59f8108c
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
surya.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Service = "C:\\Program Files (x86)\\ARP Service\\arpsvc.exe"	7617294dae18fa4921118522d9ff72b6.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7617294dae18fa4921118522d9ff72b6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ARP Service\arpsvc.exe	7617294dae18fa4921118522d9ff72b6.exe
File opened for modification	C:\Program Files (x86)\ARP Service\arpsvc.exe	7617294dae18fa4921118522d9ff72b6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1512	schtasks.exe
1400	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
880	7617294dae18fa4921118522d9ff72b6.exe
1324	7617294dae18fa4921118522d9ff72b6.exe
1324	7617294dae18fa4921118522d9ff72b6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	7617294dae18fa4921118522d9ff72b6.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	7617294dae18fa4921118522d9ff72b6.exe
Token: SeDebugPrivilege	1324	7617294dae18fa4921118522d9ff72b6.exe
Token: SeDebugPrivilege	1324	7617294dae18fa4921118522d9ff72b6.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1400	880	7617294dae18fa4921118522d9ff72b6.exe	27
PID 880 wrote to memory of 1400	880	7617294dae18fa4921118522d9ff72b6.exe	27
PID 880 wrote to memory of 1400	880	7617294dae18fa4921118522d9ff72b6.exe	27
PID 880 wrote to memory of 1400	880	7617294dae18fa4921118522d9ff72b6.exe	27
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 880 wrote to memory of 1324	880	7617294dae18fa4921118522d9ff72b6.exe	29
PID 1324 wrote to memory of 1628	1324	7617294dae18fa4921118522d9ff72b6.exe	30
PID 1324 wrote to memory of 1628	1324	7617294dae18fa4921118522d9ff72b6.exe	30
PID 1324 wrote to memory of 1628	1324	7617294dae18fa4921118522d9ff72b6.exe	30
PID 1324 wrote to memory of 1628	1324	7617294dae18fa4921118522d9ff72b6.exe	30
PID 1324 wrote to memory of 1512	1324	7617294dae18fa4921118522d9ff72b6.exe	32
PID 1324 wrote to memory of 1512	1324	7617294dae18fa4921118522d9ff72b6.exe	32
PID 1324 wrote to memory of 1512	1324	7617294dae18fa4921118522d9ff72b6.exe	32
PID 1324 wrote to memory of 1512	1324	7617294dae18fa4921118522d9ff72b6.exe	32

C:\Users\Admin\AppData\Local\Temp\7617294dae18fa4921118522d9ff72b6.exe
"C:\Users\Admin\AppData\Local\Temp\7617294dae18fa4921118522d9ff72b6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rgOHbB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA323.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1400
- C:\Users\Admin\AppData\Local\Temp\7617294dae18fa4921118522d9ff72b6.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1628
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "ARP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA95B.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpA323.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA323.tmp
Size 1KB
SHA256 13d24d3f8afd266b4152021ad7d179800a24e03d70f695494899d9cae419d6be
MD5 c3ca53313b87acd88df155b34f8d2ff9
SHA1 a50fd4f329e3b82786634cdbb6324baa83e54e7d
SHA512 d7c5ca72ffbe404a36ef473ab038df7f86ed35c41f5d1b60d0801045fd76f88ac95f28715c87385d5e1ab66ad39c3a534456947a6ed37d55ebd9c196817630ac
MD5 SHA1 SHA512

Submit Download

tmpA851.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp
Size 1KB
SHA256 3bb88fe8d0406aebc0b2bca55793d881c59d6fe583daaac4dc1de9758fa7c829
MD5 bfff1dbc040d5d8a39164d90de0a20af
SHA1 d21ff0ec88971db343557ae26c2f59a6d419850a
SHA512 e75f5c6e570995771cd06effa1edeb4a0d1fd8d16afb4064c4b642a7dc6e1126419bb88da3e671a567272e96b431fb97614e0babc333c74c2cd7e64aa8b919fb
MD5 SHA1 SHA512

Submit Download

tmpA95B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA95B.tmp
Size 1KB
SHA256 6259ac4e6859a1b528d77ccea12b378f7dfa1eff359d9b8899414b4b1c484699
MD5 1badb6e2b29a1c4bfff3c179d53ab96b
SHA1 4b2ad3e5f3826d252d1c8bf1c8f0702f39129fa1
SHA512 36338e2a74fd85c5f2c84be009981a7260692c1bcb121a42018209031082da69bf65640702d53e28b54871f9d44e65fdbebaf4771c530699c3e93981b58129b4
MD5 SHA1 SHA512

Submit Download

memory/880-55-0x0000000075711000-0x0000000075713000-memory.dmp

Download

memory/880-56-0x0000000000230000-0x000000000023A000-memory.dmp

Download

memory/880-57-0x00000000050A0000-0x000000000512E000-memory.dmp

Download

memory/880-58-0x0000000000740000-0x000000000077A000-memory.dmp

Download

memory/880-54-0x0000000000AA0000-0x0000000000B32000-memory.dmp

Download

memory/1324-65-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-64-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-79-0x0000000000510000-0x000000000051C000-memory.dmp

Download

memory/1324-67-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-72-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-70-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-81-0x0000000000650000-0x000000000065A000-memory.dmp

Download

memory/1324-62-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-80-0x0000000000620000-0x000000000063E000-memory.dmp

Download

memory/1324-61-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1324-78-0x00000000004F0000-0x00000000004FA000-memory.dmp

Download