nanocore | hxxp://81[.]161[.]229[.]110/htdocs/

General

Target

http://81.161.229.110/htdocs/

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

katiebrady616.ddns.net:705

Mutex

6614a0d3-74cf-4cba-9b22-46de5dee170d

Attributes

activate_away_mode
true
backup_connection_host
katiebrady616.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-10T20:30:36.872525236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
705
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
6614a0d3-74cf-4cba-9b22-46de5dee170d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
katiebrady616.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

YjXWQorEXSCmNzB.exe

pid process

4936 YjXWQorEXSCmNzB.exe

pid	process
4936	YjXWQorEXSCmNzB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

YjXWQorEXSCmNzB.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe"	YjXWQorEXSCmNzB.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

YjXWQorEXSCmNzB.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA YjXWQorEXSCmNzB.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YjXWQorEXSCmNzB.exe

Drops file in Program Files directory 2 IoCs

Processes:

YjXWQorEXSCmNzB.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	YjXWQorEXSCmNzB.exe
File opened for modification	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	YjXWQorEXSCmNzB.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 467899b2bcaed801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{26AE9C82-2B0B-11ED-AECB-F22D08015D11} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30981911"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30981911"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d4e10018bfd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d9120000000000200000000001066000000010000200000000d35845f4dafab743e333d2bd6019e3201c17f31d236e93d0586cb2f8795e492000000000e8000000002000020000000ae744cfc1236cc85330d41965ecbe0e2a5c7635ef817c072f343f9918d81f5a62000000044715be14c48ad052fe50aca2dd16a412df509a97c196e3bed8e2a5b01a6811f40000000afa374fd73f32fb053f6dd369f69914f55b8be8f9b33ef33dd98f0f37c39a9189f833d648c63dbc067d847a312f19edbdf3dd89b2b8fb5255fc03245c695fc4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4217891736"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4288207814"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30981911"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "368921219"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d9120000000000200000000001066000000010000200000000e85277d388f720efbe178ff396e739f5094d3ddf0c7130e8afdddece9ddf929000000000e80000000020000200000009f7e2ea52a4ae5ba47961d25f1e6f635d5731f10b83b7fa67d47981aa29f8ea420000000fc132935ad6aca64882baca4b0e9b7566687058fe59b9a3feaeb75dea42f31b24000000044956dffcaacf9b214df8aed5ceb0af0fc8fdb3cd2dd2d51d9f9f0ce9ba84cb398a70f5f469d31cc20f31edd593e7f3879d350e3f88a20a7a28a55addda9f37a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{B89BAE77-BE43-414A-BF4A-B03BC78553EA}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4217891736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e2cd0118bfd801	iexplore.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

YjXWQorEXSCmNzB.exe

pid process

4936 YjXWQorEXSCmNzB.exe
4936 YjXWQorEXSCmNzB.exe
4936 YjXWQorEXSCmNzB.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

YjXWQorEXSCmNzB.exe

pid process

4936 YjXWQorEXSCmNzB.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

YjXWQorEXSCmNzB.exe

description pid process

Token: SeDebugPrivilege 4936 YjXWQorEXSCmNzB.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1224 iexplore.exe
1224 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1224 iexplore.exe
1224 iexplore.exe
2304 IEXPLORE.EXE
2304 IEXPLORE.EXE
2304 IEXPLORE.EXE
2304 IEXPLORE.EXE

pid	process
4936	YjXWQorEXSCmNzB.exe
4936	YjXWQorEXSCmNzB.exe
4936	YjXWQorEXSCmNzB.exe

pid	process
4936	YjXWQorEXSCmNzB.exe

description	pid	process
Token: SeDebugPrivilege	4936	YjXWQorEXSCmNzB.exe

pid	process
1224	iexplore.exe
1224	iexplore.exe

pid	process
1224	iexplore.exe
1224	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1224 wrote to memory of 2304	1224	iexplore.exe	IEXPLORE.EXE
PID 1224 wrote to memory of 2304	1224	iexplore.exe	IEXPLORE.EXE
PID 1224 wrote to memory of 2304	1224	iexplore.exe	IEXPLORE.EXE
PID 1224 wrote to memory of 4936	1224	iexplore.exe	YjXWQorEXSCmNzB.exe
PID 1224 wrote to memory of 4936	1224	iexplore.exe	YjXWQorEXSCmNzB.exe
PID 1224 wrote to memory of 4936	1224	iexplore.exe	YjXWQorEXSCmNzB.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://81.161.229.110/htdocs/
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304

C:\Users\Admin\Downloads\YjXWQorEXSCmNzB.exe
"C:\Users\Admin\Downloads\YjXWQorEXSCmNzB.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat

Filesize
16KB

MD5
ccb1346ff55b6fe5ce7ad19aac3928bf

SHA1
3f21eed84d6f6f239627165d6f8a17a0e3ffc16b

SHA256
314e564d1d700696d11732c1f7c863d4ab5714ad2ad180815683a41ecde46c42

SHA512
5fa738bf5a69d28ce511279d154e7900f97edf18e0c6632d2a285a09c2de8fbbd1117493497a36b9c762cf4ca924874ea4df7deb194f1ff81ca77e5b7af01386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat

Filesize
47KB

MD5
dd62364f65e260f3f99fc00e46613acb

SHA1
a36180bf85c92c2c1f547889459a3c1fc3eb9638

SHA256
08b618b270f48e91d2bc3bd073b1ecdafb38f9628bd6eb90f80b980eb2637e0e

SHA512
2af912dc17396d5670338dc04af6abc6a5fe840e025302c0e7f0278d08b20bf642da689079262651a932a3efe4432579761d07863649d3afba1a82f341789bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\favicon[1].ico

Filesize
30KB

MD5
6eb4a43cb64c97f76562af703893c8fd

SHA1
c50c4273b9d2433c6069454f971ed6653e07c126

SHA256
1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9

SHA512
3bae9380d8f0d45617ecf9d0d43818b7f8f83b61ecbd5e6dbd189c19d5853f92aa47965ad257cf712e49c03652f129dca47e8a8dbd86d62e614acc99ea931181

Download Submit
C:\Users\Admin\Downloads\YjXWQorEXSCmNzB.exe

Filesize
202KB

MD5
f47f4f40886f05a734e2d6e584d6ab10

SHA1
b2f9e9feeb10c857094003049e32b0aeb2e0ef9d

SHA256
9b144809ef27214ff63ef708350546d6aa01929f4bb8cfb12f3efc462b0b0cd1

SHA512
26f073459367829272ab0356475b9191b5e247c3ad66cf5c52465389eca662823c830717341fabfce8f199f6d0185c5e7118e0597b7b01f4057dfe520ac9e7df

Download Submit
C:\Users\Admin\Downloads\YjXWQorEXSCmNzB.exe.70ivmfg.partial

Filesize
202KB

MD5
f47f4f40886f05a734e2d6e584d6ab10

SHA1
b2f9e9feeb10c857094003049e32b0aeb2e0ef9d

SHA256
9b144809ef27214ff63ef708350546d6aa01929f4bb8cfb12f3efc462b0b0cd1

SHA512
26f073459367829272ab0356475b9191b5e247c3ad66cf5c52465389eca662823c830717341fabfce8f199f6d0185c5e7118e0597b7b01f4057dfe520ac9e7df

Download Submit
memory/4936-136-0x0000000000000000-mapping.dmp

Download
memory/4936-138-0x000000006F610000-0x000000006FBC1000-memory.dmp

Filesize
5.7MB

Download
memory/4936-139-0x000000006F610000-0x000000006FBC1000-memory.dmp

Filesize
5.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads