nanocore | cc5f03883d2ef8ebbce7bbb4889577d87007332c78701184ddae5768edf2d517

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2022, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GiroSwift.exe
Size 1.0MB
Sample220823-red8gagbe5
SHA256 cc5f03883d2ef8ebbce7bbb4889577d87007332c78701184ddae5768edf2d517
MD5 056365c74e40381e7f291eb4d5a9a243
SHA1 01bb8aa5dc4a4b59e2523bae86c2d9b479abcf6a
SHA512 28edd61d3983a51dec09c3d8ea063fbc0d83ada88d2d354e4b94d8b8712ee87cd76d278a3d6f44e2091f7f9b911fe66bc17e033771b61ccff5d5d308e316fd31
SSDEEP 12288:ffi0b8u3XDG264KC5AhM3Ages8rR7euN21u83ccdUhDNPV3y2SYwXlLqH5Ln4H4B:/nG2VAhE8Nzz7uaNFy2SO5Ln4H444h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

79.134.225.30:1717

Mutex

a2c82c99-2ba7-4d46-80e6-925316775df2

Attributes

activate_away_mode
true
backup_connection_host
79.134.225.30
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-03T10:08:02.402597736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1717
default_group
Giro
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
a2c82c99-2ba7-4d46-80e6-925316775df2
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
79.134.225.30
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	GiroSwift.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Monitor = "C:\\Program Files (x86)\\AGP Monitor\\agpmon.exe"	GiroSwift.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GiroSwift.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3088 set thread context of 3216	3088	GiroSwift.exe	100

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AGP Monitor\agpmon.exe	GiroSwift.exe
File opened for modification	C:\Program Files (x86)\AGP Monitor\agpmon.exe	GiroSwift.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3088	GiroSwift.exe
5100	powershell.exe
2936	powershell.exe
3088	GiroSwift.exe
3088	GiroSwift.exe
3088	GiroSwift.exe
2936	powershell.exe
5100	powershell.exe
3216	GiroSwift.exe
3216	GiroSwift.exe
3216	GiroSwift.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3216	GiroSwift.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	GiroSwift.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	3216	GiroSwift.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2936	3088	GiroSwift.exe	93
PID 3088 wrote to memory of 2936	3088	GiroSwift.exe	93
PID 3088 wrote to memory of 2936	3088	GiroSwift.exe	93
PID 3088 wrote to memory of 5100	3088	GiroSwift.exe	95
PID 3088 wrote to memory of 5100	3088	GiroSwift.exe	95
PID 3088 wrote to memory of 5100	3088	GiroSwift.exe	95
PID 3088 wrote to memory of 1652	3088	GiroSwift.exe	97
PID 3088 wrote to memory of 1652	3088	GiroSwift.exe	97
PID 3088 wrote to memory of 1652	3088	GiroSwift.exe	97
PID 3088 wrote to memory of 880	3088	GiroSwift.exe	99
PID 3088 wrote to memory of 880	3088	GiroSwift.exe	99
PID 3088 wrote to memory of 880	3088	GiroSwift.exe	99
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100
PID 3088 wrote to memory of 3216	3088	GiroSwift.exe	100

C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe
"C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qsoqyg.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qsoqyg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DA5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe
  "C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe"
  2⤵
  PID:880
- C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe
  "C:\Users\Admin\AppData\Local\Temp\GiroSwift.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 025b39e33e740a80a09a6c905661ab042ab3db85445ac0016efaebca14e76bbb
MD5 15a7fcd415c1c3207a7a7ccfef724200
SHA1 99e6fb3ae70dac7d428e7ffc3cdb630f60a425b5
SHA512 c7af0fe5d6638b39bae48c9b09e611b1443c3f2621a204543becef5d228b2194942865f73e6e51ed023b477aa1256f0a82a7932598050e9dfdd624fcaf02704f
SSDEEP 384:3sf+BG9i+E7zLSvBizJk6Ao9o28HnK6seYLME/N03SoZCfYSgcjEDkyQ0gdEtkKF:cfU7YoeCo28HnNgrWS1WCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp3DA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3DA5.tmp
Size 1KB
SHA256 07da4afa06d7ea2b26497de78c3d1b3f3e4484b03223a30cdab721692b57d3d2
MD5 e52dd3555dbfd07e01b7369af8743c4a
SHA1 9b8f392358a7d8d060ac899017745822564603be
SHA512 d0731d7edd7c3f58bb434cb5e24c7d8f6eecc74957002c136e284084566bd9e3fb5a7a2a7a43335e421e9d4445219de63f8bdeb1948a328c0d921778beda5270
MD5 SHA1 SHA512

Submit Download

memory/2936-153-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/2936-150-0x00000000065B0000-0x00000000065E2000-memory.dmp

Download

memory/2936-140-0x00000000026B0000-0x00000000026E6000-memory.dmp

Download

memory/2936-160-0x0000000007600000-0x0000000007608000-memory.dmp

Download

memory/2936-142-0x00000000052D0000-0x00000000058F8000-memory.dmp

Download

memory/2936-159-0x0000000007620000-0x000000000763A000-memory.dmp

Download

memory/2936-144-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/2936-158-0x0000000007510000-0x000000000751E000-memory.dmp

Download

memory/2936-157-0x0000000007560000-0x00000000075F6000-memory.dmp

Download

memory/2936-156-0x0000000007350000-0x000000000735A000-memory.dmp

Download

memory/2936-155-0x00000000072E0000-0x00000000072FA000-memory.dmp

Download

memory/2936-149-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

Download

memory/2936-151-0x0000000075C00000-0x0000000075C4C000-memory.dmp

Download

memory/3088-132-0x0000000000480000-0x000000000058A000-memory.dmp

Download

memory/3088-135-0x0000000004F40000-0x0000000004F4A000-memory.dmp

Download

memory/3088-136-0x00000000089A0000-0x0000000008A3C000-memory.dmp

Download

memory/3088-134-0x0000000004F70000-0x0000000005002000-memory.dmp

Download

memory/3088-133-0x0000000005520000-0x0000000005AC4000-memory.dmp

Download

memory/3216-148-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/5100-152-0x0000000075C00000-0x0000000075C4C000-memory.dmp

Download

memory/5100-154-0x00000000076F0000-0x0000000007D6A000-memory.dmp

Download

memory/5100-145-0x0000000005740000-0x00000000057A6000-memory.dmp

Download

memory/5100-143-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

Download