nanocore | 53fbbcf782f9768c02f5637b0a11ba0d63b9b2210f555999272ba6dbe709d30b

General

Target

Acknowledgment NEW ORDER.exe
Size

515KB
MD5

c8e4f84b78ebd0930e7902c87e61bcf1
SHA1

5b30e2296d80fb4d53bd63e255952e30ad18c31d
SHA256

d406a7a9f53d855c09c085482979c935b2668db373e5809b7e48dedfb1206a9f
SHA512

435bc9f00ea83014c05f899a1f47c4cf9ba83c24e200ef75712de8b91250337802a8a6c021d0b490bd8d08aa42bdd1729f5e00c0ae4624ac0c138eb8f8650fe0

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

evapimp.myq-see.com:1010

Mutex

7e9d8301-bfb3-41d8-8ccb-7adef88d322a

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-05-03T10:53:25.539363436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1010
default_group
FABRIC
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7e9d8301-bfb3-41d8-8ccb-7adef88d322a
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
evapimp.myq-see.com
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Acknowledgment NEW ORDER.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Acknowledgment NEW ORDER.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Acknowledgment NEW ORDER.exe

description pid process target process

PID 2012 set thread context of 1048 2012 Acknowledgment NEW ORDER.exe Acknowledgment NEW ORDER.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1056 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Acknowledgment NEW ORDER.exe

pid process

1048 Acknowledgment NEW ORDER.exe
1048 Acknowledgment NEW ORDER.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Acknowledgment NEW ORDER.exe

description pid process

Token: SeDebugPrivilege 1048 Acknowledgment NEW ORDER.exe

description	pid	process	target process
PID 2012 set thread context of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe

pid	process
1056	schtasks.exe

pid	process
1048	Acknowledgment NEW ORDER.exe
1048	Acknowledgment NEW ORDER.exe

description	pid	process
Token: SeDebugPrivilege	1048	Acknowledgment NEW ORDER.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Acknowledgment NEW ORDER.exe

description	pid	process	target process
PID 2012 wrote to memory of 1056	2012	Acknowledgment NEW ORDER.exe	schtasks.exe
PID 2012 wrote to memory of 1056	2012	Acknowledgment NEW ORDER.exe	schtasks.exe
PID 2012 wrote to memory of 1056	2012	Acknowledgment NEW ORDER.exe	schtasks.exe
PID 2012 wrote to memory of 1056	2012	Acknowledgment NEW ORDER.exe	schtasks.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe
PID 2012 wrote to memory of 1048	2012	Acknowledgment NEW ORDER.exe	Acknowledgment NEW ORDER.exe

C:\Users\Admin\AppData\Local\Temp\Acknowledgment NEW ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\Acknowledgment NEW ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KXtjcSAHzIh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF9BB.tmp"
2⤵
- Creates scheduled task(s)
PID:1056

C:\Users\Admin\AppData\Local\Temp\Acknowledgment NEW ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\Acknowledgment NEW ORDER.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF9BB.tmp
Filesize
1KB

MD5
673fbad3b9d05f94b4277e083ea6dd3c

SHA1
0bec6408b53b1816180b726433803eba62024441

SHA256
e979ceac3e7a53217c047ae77d1ce49d4c3fda7f030ac722837260a167456efc

SHA512
331817a11872e22e4fe2096b85a04abe1d304a035781773eeccba528bfcf45c307481e6d89cb44abe455da3fd77d1ef8e51060a51dab351b155efeb78da78d6c

Download Submit
memory/1048-68-0x000000000041E792-mapping.dmp

Download
memory/1048-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1048-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1048-76-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/1048-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1048-75-0x0000000000440000-0x000000000045E000-memory.dmp

Filesize
120KB

Download
memory/1048-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1048-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1048-74-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/1048-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1048-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1056-59-0x0000000000000000-mapping.dmp

Download
memory/2012-54-0x0000000000E20000-0x0000000000EA8000-memory.dmp

Filesize
544KB

Download
memory/2012-56-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2012-57-0x0000000004FC0000-0x000000000501C000-memory.dmp

Filesize
368KB

Download
memory/2012-55-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download
memory/2012-58-0x0000000000A30000-0x0000000000A6C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads