nanocore | 9973ff08337e84d15ceaa51863c1b0c26fd6c31c51a76916174410eb077cde6f

General

Target

USPS.exe
Size

1.3MB
MD5

2b88bb3a1dc7d15f7ee00323f4d8f142
SHA1

920e2fadf1372cd0d0f0c5f086d18a7eda79587f
SHA256

944b633d92799fe6aeefae5de7945b6b0b69020ed669d9d7e68ebd80868771e6
SHA512

445fa6eb36f0e7748a8e803819a11df1905076ef0b0d33c431aef26b35997df774bd3a46eac04f9be8a4f78550f1f99384bef0589490637fee529fecc84aab0e

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

u852121.nvpn.to:3410

Mutex

6600ee3d-9113-495f-9807-2cbadaeabc68

Attributes

activate_away_mode
true
backup_connection_host
u852121.nvpn.to
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-03-29T22:15:11.322294736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
3410
default_group
usp
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
6600ee3d-9113-495f-9807-2cbadaeabc68
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
u852121.nvpn.to
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Drops startup file 1 IoCs

Processes:

USPS.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WWAHost.url USPS.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

USPS.exe

description pid process target process

PID 904 set thread context of 1092 904 USPS.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

1092 MSBuild.exe
1092 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

1092 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1092 MSBuild.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

USPS.exe

pid process

904 USPS.exe
904 USPS.exe
904 USPS.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

USPS.exe

pid process

904 USPS.exe
904 USPS.exe
904 USPS.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WWAHost.url	USPS.exe

description	pid	process	target process
PID 904 set thread context of 1092	904	USPS.exe	MSBuild.exe

pid	process
1092	MSBuild.exe
1092	MSBuild.exe

pid	process
1092	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1092	MSBuild.exe

pid	process
904	USPS.exe
904	USPS.exe
904	USPS.exe

pid	process
904	USPS.exe
904	USPS.exe
904	USPS.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

USPS.exe

description	pid	process	target process
PID 904 wrote to memory of 1092	904	USPS.exe	MSBuild.exe
PID 904 wrote to memory of 1092	904	USPS.exe	MSBuild.exe
PID 904 wrote to memory of 1092	904	USPS.exe	MSBuild.exe
PID 904 wrote to memory of 1092	904	USPS.exe	MSBuild.exe
PID 904 wrote to memory of 1092	904	USPS.exe	MSBuild.exe
PID 904 wrote to memory of 1092	904	USPS.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\USPS.exe
"C:\Users\Admin\AppData\Local\Temp\USPS.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-54-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download
memory/904-55-0x0000000000750000-0x00000000007B6000-memory.dmp

Filesize
408KB

Download
memory/904-56-0x0000000000870000-0x00000000008D6000-memory.dmp

Filesize
408KB

Download
memory/1092-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1092-64-0x000000000041E792-mapping.dmp

Download
memory/1092-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1092-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1092-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1092-68-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/1092-69-0x0000000000366000-0x0000000000377000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads