nanocore | bd5a0d5bcd231bdbb21594cb15181d10906e810db993db32038676f9443c70db

General

Target

INVOICE_.exe
Size

426KB
MD5

3aabfce5e93698b645131b1c75805f91
SHA1

42bfb73931a29f5141d2f83ca1b4b0de931051ad
SHA256

3c26a85d0b5ca9e7a75dfff1b355cdf2a0aeac1dc892fe9be7def4085eb2bc74
SHA512

e4eadbd2fe272250cd196e5ccb29ec40e884e4e9d25a641df7cf81761ff596b432adeefa5abf4bea5ed9897643db79c05b85553063570ea3a125e38ec426dccc

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

u852117.nvpn.to:5638

Mutex

c20191a5-cd52-4887-8771-2d1dca5667b7

Attributes

activate_away_mode
true
backup_connection_host
u852117.nvpn.to
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-19T15:09:07.734275836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5638
default_group
BEGINS
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c20191a5-cd52-4887-8771-2d1dca5667b7
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
u852117.nvpn.to
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

INVOICE_.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	INVOICE_.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

INVOICE_.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA INVOICE_.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICE_.exe

description pid process target process

PID 4900 set thread context of 1708 4900 INVOICE_.exe INVOICE_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4312 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

INVOICE_.exe

pid process

1708 INVOICE_.exe
1708 INVOICE_.exe
1708 INVOICE_.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

INVOICE_.exe

pid process

1708 INVOICE_.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

INVOICE_.exe

description pid process

Token: SeDebugPrivilege 1708 INVOICE_.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	INVOICE_.exe

description	pid	process	target process
PID 4900 set thread context of 1708	4900	INVOICE_.exe	INVOICE_.exe

pid	process
4312	schtasks.exe

pid	process
1708	INVOICE_.exe
1708	INVOICE_.exe
1708	INVOICE_.exe

pid	process
1708	INVOICE_.exe

description	pid	process
Token: SeDebugPrivilege	1708	INVOICE_.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

INVOICE_.exe

description	pid	process	target process
PID 4900 wrote to memory of 4312	4900	INVOICE_.exe	schtasks.exe
PID 4900 wrote to memory of 4312	4900	INVOICE_.exe	schtasks.exe
PID 4900 wrote to memory of 4312	4900	INVOICE_.exe	schtasks.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe
PID 4900 wrote to memory of 1708	4900	INVOICE_.exe	INVOICE_.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE_.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE_.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oXwzmYgQkRz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6438.tmp"
2⤵
- Creates scheduled task(s)
PID:4312

C:\Users\Admin\AppData\Local\Temp\INVOICE_.exe
"{path}"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6438.tmp
Filesize
1KB

MD5
c3ed5df5d9618cd02a0bc2c0dbbf01a2

SHA1
0adfaa1ddb681e36e4e59be379fb6184f018bec0

SHA256
614916dfda6f2ea79df5edcb192f76568fcdcde63c4815c07a5eb2d8a0af6d42

SHA512
d23077cc77c2dbeefb95dad85a43e71275e25a6b6b4bc110d73b2da9a86dd671bf0ff55868155ef64079a8b3da40f88a0230ac34b8c4964efc3f6e7737a06b8f

Download Submit
memory/1708-133-0x0000000000000000-mapping.dmp

Download
memory/1708-134-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1708-135-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/4312-131-0x0000000000000000-mapping.dmp

Download
memory/4900-130-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads