nanocore | 7bafce52c3b6799ed45e82512ae4c759a6e0c7a3a884c29bd68258e5f8051700

General

Target

doc.exe
Size

577KB
MD5

83492ae54563bfc4446c7f06b607190f
SHA1

359537f5fc92090b1cf16701c3855013beead6e6
SHA256

5af772f42ab8e1672905cbf0494eb367cd687486cef182c49b71a72d7368c012
SHA512

286cde57794a9a277602ee6e81c4432578c3a1bddf20157b9da71908505ceb71df6fa5abd1aea05c7fc0715f30a2ef9ffe7a8b816ee74cd79ad3172d521b0888

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

isiefi.ddns.net:9909

Mutex

1c87c2a2-27a9-4062-b41f-749df56c3f54

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-28T18:27:52.322706536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9909
default_group
latest
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1c87c2a2-27a9-4062-b41f-749df56c3f54
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
isiefi.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

doc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	doc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	doc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service = "C:\\Program Files (x86)\\DSL Service\\dslsv.exe"	MSBuild.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

doc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	doc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	doc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

doc.exe

description pid process target process

PID 1824 set thread context of 1656 1824 doc.exe MSBuild.exe

description	pid	process	target process
PID 1824 set thread context of 1656	1824	doc.exe	MSBuild.exe

Drops file in Program Files directory 2 IoCs

Processes:

MSBuild.exe

description	ioc	process
File created	C:\Program Files (x86)\DSL Service\dslsv.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\DSL Service\dslsv.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

940 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

doc.exeMSBuild.exe

pid process

1824 doc.exe
1656 MSBuild.exe
1656 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

doc.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1824 doc.exe
Token: SeDebugPrivilege 1656 MSBuild.exe

pid	process
940	schtasks.exe

pid	process
1824	doc.exe
1656	MSBuild.exe
1656	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1824	doc.exe
Token: SeDebugPrivilege	1656	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

doc.exe

description	pid	process	target process
PID 1824 wrote to memory of 940	1824	doc.exe	schtasks.exe
PID 1824 wrote to memory of 940	1824	doc.exe	schtasks.exe
PID 1824 wrote to memory of 940	1824	doc.exe	schtasks.exe
PID 1824 wrote to memory of 940	1824	doc.exe	schtasks.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe
PID 1824 wrote to memory of 1656	1824	doc.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\doc.exe
"C:\Users\Admin\AppData\Local\Temp\doc.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NZxUZIhdthv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCCE1.tmp"
2⤵
- Creates scheduled task(s)
PID:940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCCE1.tmp

Filesize
1KB

MD5
2e48f256ffa1c44e3b890a0428e3b34f

SHA1
2c7702497d7bd4138da054d67842772d6a365a23

SHA256
b8ce6ffc579e9c990826354655476e223c6949b29f555e4b4d1441c040f36793

SHA512
a8bd80ec7277687abfabfb5c9f5d79c063ba6b341d9c10d5351378ab71562755a9b0623e5cdf610b16f2fe4f056b590572a099a53b5c82c99ceb6369dd1a78d6

Download Submit
memory/940-56-0x0000000000000000-mapping.dmp

Download
memory/1656-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-65-0x000000000041E792-mapping.dmp

Download
memory/1656-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1656-71-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1656-72-0x0000000000D86000-0x0000000000D97000-memory.dmp

Filesize
68KB

Download
memory/1824-55-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1824-54-0x0000000075E41000-0x0000000075E43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads