nanocore | fc5e3bcf40112d3c02ea2ff40593239058317103e208bf18bf869447387c2b4e

General

Target

AHF PO 00035440PDF.exe
Size

498KB
MD5

1ea3b1a102cee26912254a6a1e2dc627
SHA1

635ea4fe2d801ffcbdb2284f74fdd78c9c4ed795
SHA256

4329ace3154dca4e544733d0f2f10abc543755dde977d9bb6998fb7368186bb8
SHA512

e63c4b691e9618f6f86097f71b75083d8cc507a20c5e8a1b4fbd513fd01d0c2a909ba4585f56bcbb566bafd06293b2afdfcb0974f254152b295a9b1ad46dab61

Score

10^/10

nanocore evasion keylogger spyware stealer suricata trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

sack517.ddns.net:5656

sack517.duckdns.org:5656

Mutex

c7a8fda1-e948-4efe-8823-4e1fe1d7a7c1

Attributes

activate_away_mode
true
backup_connection_host
sack517.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-02T00:28:26.601869136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
5656
default_group
SACK
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c7a8fda1-e948-4efe-8823-4e1fe1d7a7c1
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
sack517.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
suricata
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AHF PO 00035440PDF.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AHF PO 00035440PDF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AHF PO 00035440PDF.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AHF PO 00035440PDF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AHF PO 00035440PDF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	AHF PO 00035440PDF.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

AHF PO 00035440PDF.exe

description pid process target process

PID 1944 set thread context of 524 1944 AHF PO 00035440PDF.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1716 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

AHF PO 00035440PDF.exeMSBuild.exe

pid process

1944 AHF PO 00035440PDF.exe
1944 AHF PO 00035440PDF.exe
524 MSBuild.exe
524 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

524 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AHF PO 00035440PDF.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1944 AHF PO 00035440PDF.exe
Token: SeDebugPrivilege 524 MSBuild.exe

description	pid	process	target process
PID 1944 set thread context of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe

pid	process
1716	schtasks.exe

pid	process
1944	AHF PO 00035440PDF.exe
1944	AHF PO 00035440PDF.exe
524	MSBuild.exe
524	MSBuild.exe

pid	process
524	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1944	AHF PO 00035440PDF.exe
Token: SeDebugPrivilege	524	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

AHF PO 00035440PDF.exe

description	pid	process	target process
PID 1944 wrote to memory of 1716	1944	AHF PO 00035440PDF.exe	schtasks.exe
PID 1944 wrote to memory of 1716	1944	AHF PO 00035440PDF.exe	schtasks.exe
PID 1944 wrote to memory of 1716	1944	AHF PO 00035440PDF.exe	schtasks.exe
PID 1944 wrote to memory of 1716	1944	AHF PO 00035440PDF.exe	schtasks.exe
PID 1944 wrote to memory of 1756	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 1756	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 1756	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 1756	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe
PID 1944 wrote to memory of 524	1944	AHF PO 00035440PDF.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\AHF PO 00035440PDF.exe
"C:\Users\Admin\AppData\Local\Temp\AHF PO 00035440PDF.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oghLwPEhdgsCQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp122A.tmp"
2⤵
- Creates scheduled task(s)
PID:1716

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
PID:1756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp122A.tmp
Filesize
1KB

MD5
d0517c973a8c539e40b17e391ccddb93

SHA1
d2b753ea99deedb1b0f8868b16e3afe174bf3ee7

SHA256
7913ee2e1c4d238fd58c81655bb741ba09a0284ecc69e569241ffa284b769e2a

SHA512
2aeb3ce4b21da9ce309df72633d8875c41b13d80b9dd22041ff8cb09ce9d1dae555176125b1234610d1ea4e3daefb65b98208f22b3c7e08eaa5fdb449f44ce45

Download Submit
memory/524-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-65-0x000000000041E792-mapping.dmp

Download
memory/524-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/524-71-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download
memory/524-72-0x0000000000E66000-0x0000000000E77000-memory.dmp

Filesize
68KB

Download
memory/1716-56-0x0000000000000000-mapping.dmp

Download
memory/1944-55-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-54-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads