nanocore | 628997d79a873d507ff722975be64f427582c08b6cc8f661c3aefe0de6a911af

General

Target

fwfuJFhRr1BqCWi.exe
Size

589KB
MD5

372d925870b10617a1bafa396d646bd9
SHA1

647431572f8119f401092f8874b087d1fa468ac4
SHA256

5693fc15c7c4843819dd2e7d768f7ad32c031ca0a112cf604d38319d00e7a811
SHA512

5f632d330eab155ecda41becc25fd6be13ebe1d5da7e6d13f7b421abd223f2a78e08b33b9ee008953a5676f15a81e62031bbfa69e93e7c7949670d28025d3d75

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.140.53.51:1985

127.0.0.1:1985

Mutex

05567b5c-42af-4a71-996e-6f0227b9f4ae

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-05-09T11:35:52.395864036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
1985
default_group
Sureboy
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
05567b5c-42af-4a71-996e-6f0227b9f4ae
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
185.140.53.51
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Subsystem = "C:\\Program Files (x86)\\WPA Subsystem\\wpass.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fwfuJFhRr1BqCWi.exe

description pid process target process

PID 1752 set thread context of 1984 1752 fwfuJFhRr1BqCWi.exe RegSvcs.exe

description	pid	process	target process
PID 1752 set thread context of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Program Files (x86)\WPA Subsystem\wpass.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\WPA Subsystem\wpass.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2040 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

fwfuJFhRr1BqCWi.exeRegSvcs.exe

pid process

1752 fwfuJFhRr1BqCWi.exe
1752 fwfuJFhRr1BqCWi.exe
1752 fwfuJFhRr1BqCWi.exe
1984 RegSvcs.exe
1984 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

1984 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fwfuJFhRr1BqCWi.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1752 fwfuJFhRr1BqCWi.exe
Token: SeDebugPrivilege 1984 RegSvcs.exe

pid	process
2040	schtasks.exe

pid	process
1752	fwfuJFhRr1BqCWi.exe
1752	fwfuJFhRr1BqCWi.exe
1752	fwfuJFhRr1BqCWi.exe
1984	RegSvcs.exe
1984	RegSvcs.exe

pid	process
1984	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1752	fwfuJFhRr1BqCWi.exe
Token: SeDebugPrivilege	1984	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

fwfuJFhRr1BqCWi.exe

description	pid	process	target process
PID 1752 wrote to memory of 2040	1752	fwfuJFhRr1BqCWi.exe	schtasks.exe
PID 1752 wrote to memory of 2040	1752	fwfuJFhRr1BqCWi.exe	schtasks.exe
PID 1752 wrote to memory of 2040	1752	fwfuJFhRr1BqCWi.exe	schtasks.exe
PID 1752 wrote to memory of 2040	1752	fwfuJFhRr1BqCWi.exe	schtasks.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe
PID 1752 wrote to memory of 1984	1752	fwfuJFhRr1BqCWi.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\fwfuJFhRr1BqCWi.exe
"C:\Users\Admin\AppData\Local\Temp\fwfuJFhRr1BqCWi.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF316.tmp"
2⤵
- Creates scheduled task(s)
PID:2040

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF316.tmp

Filesize
1KB

MD5
ab15c7fe3dc23f51a8ed4545eb54a9cb

SHA1
206a5e711a5b8819deae10c568fa760a23d9308c

SHA256
2889f7b15e75b474bfa37c720f216861f138e8e39e1d2f807ce751a21086674b

SHA512
29b8f09dfa625fad63d6cae0fd9d9f9ea19a4b5a001138c5afb644c0d37f1cc2e7bf51a4242af433568b22b19613b1570a234474663cc659dd4ad54c7407a114

Download Submit
memory/1752-55-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1752-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1984-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-65-0x000000000041E792-mapping.dmp

Download
memory/1984-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-71-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads