nanocore | b49ae429c9b3e4e9e59823d44795b16fc7184e5d18d9c7a1b7f70e11ee6c4400

General

Target

SLA.exe
Size

991KB
MD5

49e17251bf1286a5b7712ed7b484f249
SHA1

8ec09396cde3e9bdbf159224084b17f991cd7868
SHA256

b49ae429c9b3e4e9e59823d44795b16fc7184e5d18d9c7a1b7f70e11ee6c4400
SHA512

c8d7f0626ba9752c77b0cc7bbd966c0aaac49d3ef0fbf61e171ebf95405a6a2710b6e26cb54fbaa80839e75804ed05017c776bc0e2dab16adddfa15119e2c481
SSDEEP

24576:6q0AUjDXY+mzo3K7/VLpL2rgCqHPh2Oj24:slmz3pE2PhNjh

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

brewsterchristophe.ddns.net:5899

194,147,5,75:5899

Mutex

b8aebc29-8c64-444f-99e6-dc4122e9bbfc

Attributes

activate_away_mode
true
backup_connection_host
194,147,5,75
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-04-29T03:26:40.572298236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5899
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
b8aebc29-8c64-444f-99e6-dc4122e9bbfc
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
brewsterchristophe.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SLA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe"	SLA.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

SLA.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SLA.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SLA.exe

description pid process target process

PID 1904 set thread context of 852 1904 SLA.exe SLA.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SLA.exe

description	pid	process	target process
PID 1904 set thread context of 852	1904	SLA.exe	SLA.exe

Drops file in Program Files directory 2 IoCs

Processes:

SLA.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Service\tcpsvc.exe	SLA.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsvc.exe	SLA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

940 schtasks.exe
1660 schtasks.exe
1784 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exeSLA.exe

pid process

1404 powershell.exe
852 SLA.exe
852 SLA.exe
852 SLA.exe
852 SLA.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SLA.exe

pid process

852 SLA.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeSLA.exe

description pid process

Token: SeDebugPrivilege 1404 powershell.exe
Token: SeDebugPrivilege 852 SLA.exe

pid	process
940	schtasks.exe
1660	schtasks.exe
1784	schtasks.exe

pid	process
1404	powershell.exe
852	SLA.exe
852	SLA.exe
852	SLA.exe
852	SLA.exe

pid	process
852	SLA.exe

description	pid	process
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	852	SLA.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

SLA.exeSLA.exe

description	pid	process	target process
PID 1904 wrote to memory of 1404	1904	SLA.exe	powershell.exe
PID 1904 wrote to memory of 1404	1904	SLA.exe	powershell.exe
PID 1904 wrote to memory of 1404	1904	SLA.exe	powershell.exe
PID 1904 wrote to memory of 1404	1904	SLA.exe	powershell.exe
PID 1904 wrote to memory of 940	1904	SLA.exe	schtasks.exe
PID 1904 wrote to memory of 940	1904	SLA.exe	schtasks.exe
PID 1904 wrote to memory of 940	1904	SLA.exe	schtasks.exe
PID 1904 wrote to memory of 940	1904	SLA.exe	schtasks.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 1904 wrote to memory of 852	1904	SLA.exe	SLA.exe
PID 852 wrote to memory of 1660	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1660	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1660	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1660	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1784	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1784	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1784	852	SLA.exe	schtasks.exe
PID 852 wrote to memory of 1784	852	SLA.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\SLA.exe
"C:\Users\Admin\AppData\Local\Temp\SLA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JbPbTA.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JbPbTA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDFA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:940
- C:\Users\Admin\AppData\Local\Temp\SLA.exe
  "C:\Users\Admin\AppData\Local\Temp\SLA.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD23E.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1660
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD319.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCDFA.tmp

Filesize
1KB

MD5
7af00ac6c553ba95cd9ab7206c9da95c

SHA1
52af8a8c57f20156786ee302c6de1afdb52dd05f

SHA256
88363d5f0c6fa193fbf335100e84c43078f985c8d065fdebccefb2577f5f566f

SHA512
7b78aa091e81d162d82b35e59734022cb17798157c0b8888ff21111ad28126e9432e86aabc9325b48608eb02d4fe3200bbf734920706a203bfdd95809620918a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD23E.tmp

Filesize
1KB

MD5
bbf9748bbf9877b37dd00d35bcd029d2

SHA1
8a7e0be1398c7faf7217d2d632f5fce8e69705eb

SHA256
bd16d85c674fb1e0dd42d6dcc54a01b90de31df65fd72d0a110b947308d6f801

SHA512
0ba961910ca199f02b71d192c41a78853306cd9157d2e5461a9825f505584cda55b28bbf27ad5fc20890320dd5671fa1cccdec64aee5168123a7588e70923959

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD319.tmp

Filesize
1KB

MD5
9db6095f31f8b4ae8173fe11424a8dfe

SHA1
4b0655ae95def24a41710ca137649d93bfa49407

SHA256
9911b4513e44521c90c020ddcddea1ddc58095055a72ec638b593bf9ee23aa72

SHA512
5bee977264545a30a2d53e674f54a4066d4529dc9162d46911b9cac957052cdc1ea7c8d60f9c57d3f33db6cb964b1e6bb2347d0e0e2af0a32ac98938c02ffc1c

Download Submit
memory/852-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-88-0x0000000000860000-0x000000000086E000-memory.dmp

Filesize
56KB

Download
memory/852-97-0x0000000002100000-0x0000000002114000-memory.dmp

Filesize
80KB

Download
memory/852-95-0x0000000002070000-0x000000000207E000-memory.dmp

Filesize
56KB

Download
memory/852-94-0x0000000002060000-0x0000000002074000-memory.dmp

Filesize
80KB

Download
memory/852-81-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/852-93-0x0000000001FD0000-0x0000000001FE0000-memory.dmp

Filesize
64KB

Download
memory/852-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-71-0x000000000041E792-mapping.dmp

Download
memory/852-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/852-92-0x0000000001FC0000-0x0000000001FD4000-memory.dmp

Filesize
80KB

Download
memory/852-91-0x0000000001FB0000-0x0000000001FBE000-memory.dmp

Filesize
56KB

Download
memory/852-96-0x0000000002090000-0x00000000020BE000-memory.dmp

Filesize
184KB

Download
memory/852-90-0x0000000001FA0000-0x0000000001FAC000-memory.dmp

Filesize
48KB

Download
memory/852-89-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/852-82-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download
memory/852-87-0x0000000000840000-0x000000000085A000-memory.dmp

Filesize
104KB

Download
memory/852-84-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/852-86-0x0000000000640000-0x0000000000652000-memory.dmp

Filesize
72KB

Download
memory/940-60-0x0000000000000000-mapping.dmp

Download
memory/1404-85-0x000000006F220000-0x000000006F7CB000-memory.dmp

Filesize
5.7MB

Download
memory/1404-83-0x000000006F220000-0x000000006F7CB000-memory.dmp

Filesize
5.7MB

Download
memory/1404-59-0x0000000000000000-mapping.dmp

Download
memory/1660-77-0x0000000000000000-mapping.dmp

Download
memory/1784-79-0x0000000000000000-mapping.dmp

Download
memory/1904-58-0x0000000005660000-0x00000000056E8000-memory.dmp

Filesize
544KB

Download
memory/1904-63-0x0000000004CA0000-0x0000000004CDA000-memory.dmp

Filesize
232KB

Download
memory/1904-56-0x00000000003A0000-0x00000000003B8000-memory.dmp

Filesize
96KB

Download
memory/1904-54-0x0000000000880000-0x000000000097E000-memory.dmp

Filesize
1016KB

Download
memory/1904-57-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/1904-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads