nanocore | 71077e55c9fc674c845b6dd687aea81d046206d91a7a3774ae5c70f9b8fc2831

General

Target

B882ITUI.exe
Size

587KB
MD5

60e77f32fe61bb0a0d5c15a97bc08110
SHA1

52c03a3566b4b06370b8610f54e9075656e273d2
SHA256

d24902af61b7ff0f4977fc9c13b8c2f8a94f1282fe5229156743e357c0654b4a
SHA512

379bae34f87de7d9003fbda71abb9d2dd81c251489b2e364f4e75dfbfcfa92bd867d921f18bec20229187a3c1c9bb9d865e78f481a16f661066bfe79782d346c

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

194.5.97.7:21600

127.0.0.1:21600

Mutex

47e60659-c2cb-4e09-8cd1-9e66d234ee01

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-05-31T09:23:22.132388636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
21600
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
47e60659-c2cb-4e09-8cd1-9e66d234ee01
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
194.5.97.7
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

B882ITUI.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Service = "C:\\Program Files (x86)\\ARP Service\\arpsvc.exe"	B882ITUI.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

B882ITUI.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B882ITUI.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

B882ITUI.exe

description pid process target process

PID 1940 set thread context of 964 1940 B882ITUI.exe B882ITUI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	B882ITUI.exe

description	pid	process	target process
PID 1940 set thread context of 964	1940	B882ITUI.exe	B882ITUI.exe

Drops file in Program Files directory 2 IoCs

Processes:

B882ITUI.exe

description	ioc	process
File created	C:\Program Files (x86)\ARP Service\arpsvc.exe	B882ITUI.exe
File opened for modification	C:\Program Files (x86)\ARP Service\arpsvc.exe	B882ITUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2036 schtasks.exe
680 schtasks.exe
1212 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

B882ITUI.exeB882ITUI.exe

pid process

1940 B882ITUI.exe
964 B882ITUI.exe
964 B882ITUI.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

B882ITUI.exeB882ITUI.exe

description pid process

Token: SeDebugPrivilege 1940 B882ITUI.exe
Token: SeDebugPrivilege 964 B882ITUI.exe

pid	process
2036	schtasks.exe
680	schtasks.exe
1212	schtasks.exe

pid	process
1940	B882ITUI.exe
964	B882ITUI.exe
964	B882ITUI.exe

description	pid	process
Token: SeDebugPrivilege	1940	B882ITUI.exe
Token: SeDebugPrivilege	964	B882ITUI.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

B882ITUI.exeB882ITUI.exe

description	pid	process	target process
PID 1940 wrote to memory of 2036	1940	B882ITUI.exe	schtasks.exe
PID 1940 wrote to memory of 2036	1940	B882ITUI.exe	schtasks.exe
PID 1940 wrote to memory of 2036	1940	B882ITUI.exe	schtasks.exe
PID 1940 wrote to memory of 2036	1940	B882ITUI.exe	schtasks.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 1940 wrote to memory of 964	1940	B882ITUI.exe	B882ITUI.exe
PID 964 wrote to memory of 680	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 680	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 680	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 680	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 1212	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 1212	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 1212	964	B882ITUI.exe	schtasks.exe
PID 964 wrote to memory of 1212	964	B882ITUI.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\B882ITUI.exe
"C:\Users\Admin\AppData\Local\Temp\B882ITUI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yKCiTBv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE486.tmp"
2⤵
- Creates scheduled task(s)
PID:2036

C:\Users\Admin\AppData\Local\Temp\B882ITUI.exe
"C:\Users\Admin\AppData\Local\Temp\B882ITUI.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp59E4.tmp"
3⤵
- Creates scheduled task(s)
PID:680

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5CD2.tmp"
3⤵
- Creates scheduled task(s)
PID:1212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp59E4.tmp
Filesize
1KB

MD5
9b8a6b2d36f409d3ea4b8a5917afb582

SHA1
685d622d43ff833787651295da0c6f6605b10d4c

SHA256
223c2562c925ae4d4567352df2d938227dd1a3d71cb7d3e81763049b8c6a5337

SHA512
ba60dd9e8a40650859b1b0b8075c1f1aba6cf408df8bc0b2ffe1cb5c55d9aa4d4ad1cb68c79aaa49ef50d8da681984dfa0441ab87a83cca8282b315f43807d5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5CD2.tmp
Filesize
1KB

MD5
1badb6e2b29a1c4bfff3c179d53ab96b

SHA1
4b2ad3e5f3826d252d1c8bf1c8f0702f39129fa1

SHA256
6259ac4e6859a1b528d77ccea12b378f7dfa1eff359d9b8899414b4b1c484699

SHA512
36338e2a74fd85c5f2c84be009981a7260692c1bcb121a42018209031082da69bf65640702d53e28b54871f9d44e65fdbebaf4771c530699c3e93981b58129b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE486.tmp
Filesize
1KB

MD5
5c620ca5950831ee7030e38e70817dc8

SHA1
135df1b752560f6b89354ed8b5fbf1266b074c6e

SHA256
cb36779b82f34a496c3f5c28be46c83e2283b43463773f9d279a9c77c692e2cf

SHA512
3497035a22c5b20ac66cb04851ed0b49f81bc6bd1a32e72e12dfe371b387a891bb917b3d9b4a3aa5852203d2177cbb716aa7bb148d225a6ef49d785061556065

Download Submit
memory/680-71-0x0000000000000000-mapping.dmp

Download
memory/964-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-65-0x000000000041E792-mapping.dmp

Download
memory/964-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-73-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/1212-74-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1940-55-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2036-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads