nanocore | 6261cd69ea54e3b007e8c74ea7f7151b6a3be1fac52c8a8b10b46051d2dca882

Analysis

max time kernel
82s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2022, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
272a5fe48eebb69d3b3ddc00eff3e804.exe
Size 790KB
Sample220802-p3hjpaehf2
SHA256 6261cd69ea54e3b007e8c74ea7f7151b6a3be1fac52c8a8b10b46051d2dca882
MD5 272a5fe48eebb69d3b3ddc00eff3e804
SHA1 c1f422862190dfdd9f1f3095141c22063a0f46f2
SHA512 b3eed6f6371629586ee6cbda7c803baa7747fa20b933ee1124240b5f39c1f5e828e616a3a066978b5dd099bf7d8d342fde3eb6447c0baf0c7320393c2e1d1c66
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

tzitziklishop.ddns.net:1665
127.0.0.1:1665

Mutex

8c91786b-767f-4ee3-aff3-a5dea25e413e

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-05-06T21:33:32.471399236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1665
default_group
July25
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
8c91786b-767f-4ee3-aff3-a5dea25e413e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tzitziklishop.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Monitor = "C:\\Program Files (x86)\\IMAP Monitor\\imapmon.exe"	272a5fe48eebb69d3b3ddc00eff3e804.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	272a5fe48eebb69d3b3ddc00eff3e804.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4292 set thread context of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\IMAP Monitor\imapmon.exe	272a5fe48eebb69d3b3ddc00eff3e804.exe
File opened for modification	C:\Program Files (x86)\IMAP Monitor\imapmon.exe	272a5fe48eebb69d3b3ddc00eff3e804.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1952	schtasks.exe
3064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	272a5fe48eebb69d3b3ddc00eff3e804.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 4292 wrote to memory of 2756	4292	272a5fe48eebb69d3b3ddc00eff3e804.exe	94
PID 2756 wrote to memory of 1952	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe	95
PID 2756 wrote to memory of 1952	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe	95
PID 2756 wrote to memory of 1952	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe	95
PID 2756 wrote to memory of 3064	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe	97
PID 2756 wrote to memory of 3064	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe	97
PID 2756 wrote to memory of 3064	2756	272a5fe48eebb69d3b3ddc00eff3e804.exe	97

C:\Users\Admin\AppData\Local\Temp\272a5fe48eebb69d3b3ddc00eff3e804.exe
"C:\Users\Admin\AppData\Local\Temp\272a5fe48eebb69d3b3ddc00eff3e804.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\272a5fe48eebb69d3b3ddc00eff3e804.exe
  "C:\Users\Admin\AppData\Local\Temp\272a5fe48eebb69d3b3ddc00eff3e804.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "IMAP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA921.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "IMAP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAA1C.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

272a5fe48eebb69d3b3ddc00eff3e804.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\272a5fe48eebb69d3b3ddc00eff3e804.exe.log
Size 2KB
SHA256 6ab5da35d0ca9bd3553aa246078a7c13e51f8507df2d42e351eabfcaafbbd6ab
MD5 9dc6959f454ad5f30992613c24cecf0e
SHA1 8d634d6e944b16919f06c7f4f1c2c1a0dbdd7ff6
SHA512 2adb5e4a2120ee8c1a6054bc83d501d3a1bed8bb42808aefbd3afe3f51903be7dc2dc75ee9ae09d3f481c0ce220d8346c333f5f0e311f36e33bba29a617cda90
MD5 SHA1 SHA512

Submit Download

tmpA921.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA921.tmp
Size 1KB
SHA256 3f81f3e6e99b8ba6ca550a8ab7d618009c88f694eb6acc744f96b0d3b841ae4f
MD5 55684523694839cef87d828141dd2c22
SHA1 662e38793c2333461b6f8f7680a5eaa5d83d1076
SHA512 cc881ccf7477abf13a094127d1b3f127a095d7af99a9671735eee5842ad4c1b427cea35cd09f3477a0327a4c8bb14c4d2742353fc24594ffbc76cc59d17689bb
MD5 SHA1 SHA512

Submit Download

tmpAA1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAA1C.tmp
Size 1KB
SHA256 2dc87169ad53fbdd7abb08f49777cb8fb05adbff4e6f6616b4c89942af8cad0f
MD5 d2d6911d94b06e405e7687a2437eafec
SHA1 9f28f9e7d8d5179d44ddaa6ca266984ed7521dea
SHA512 b5983de701ff98e944283a25f1770c1e792d52148dc1671f1d19203f8b9d10b056abcf79a17ca536a5f88ccf52f6445d8f3e75fce628666640ad8bad697dcfd1
MD5 SHA1 SHA512

Submit Download

memory/2756-137-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4292-135-0x0000000009D20000-0x0000000009D86000-memory.dmp

Download

memory/4292-130-0x0000000000550000-0x000000000061C000-memory.dmp

Download

memory/4292-134-0x0000000009C80000-0x0000000009D1C000-memory.dmp

Download

memory/4292-133-0x00000000053F0000-0x00000000053FA000-memory.dmp

Download

memory/4292-132-0x00000000051C0000-0x0000000005252000-memory.dmp

Download

memory/4292-131-0x00000000056D0000-0x0000000005C74000-memory.dmp

Download