nanocore | dbab1bf30e571bddf1c21a19bedebffd5a348145ea76abddc34a5172df49aa3b

General

Target

Jens Frodesen CV.exe
Size

1.0MB
MD5

89197e451346ed5a3ba154f394948de7
SHA1

0e9d39ec84881ca095a9c1400d64ec586e983402
SHA256

dbab1bf30e571bddf1c21a19bedebffd5a348145ea76abddc34a5172df49aa3b
SHA512

f1c6bbdcb883e3df94f497b5f7832a02aa455bec92c680cd4db0ddd9870e2ab3fbfb012c10b6e1983cda81f3652c4878639e858d48e311394f8258d06d7e47b6
SSDEEP

12288:kgqC2JPYZVj5taS55PO88JplF4HwjADqjJ5ndW+/Pi7gvkdCOVy/0BA+l6lhIiob:kg52p4J5tz688j4HojrIaE

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

brightnano1.ddns.net:1989

171.22.30.97:1989

Mutex

fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe

Attributes

activate_away_mode
true
backup_connection_host
171.22.30.97
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-10T14:34:05.030247036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1989
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
brightnano1.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Jens Frodesen CV.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Jens Frodesen CV.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Jens Frodesen CV.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe"	Jens Frodesen CV.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Jens Frodesen CV.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Jens Frodesen CV.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Jens Frodesen CV.exe

description pid process target process

PID 2672 set thread context of 936 2672 Jens Frodesen CV.exe Jens Frodesen CV.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Jens Frodesen CV.exe

description	pid	process	target process
PID 2672 set thread context of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe

Drops file in Program Files directory 2 IoCs

Processes:

Jens Frodesen CV.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\DDP Host\ddphost.exe	Jens Frodesen CV.exe
File created	C:\Program Files (x86)\DDP Host\ddphost.exe	Jens Frodesen CV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3848 schtasks.exe
3872 schtasks.exe
2872 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Jens Frodesen CV.exe

pid process

936 Jens Frodesen CV.exe
936 Jens Frodesen CV.exe
936 Jens Frodesen CV.exe
936 Jens Frodesen CV.exe
936 Jens Frodesen CV.exe
936 Jens Frodesen CV.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Jens Frodesen CV.exe

pid process

936 Jens Frodesen CV.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Jens Frodesen CV.exe

description pid process

Token: SeDebugPrivilege 936 Jens Frodesen CV.exe

pid	process
3848	schtasks.exe
3872	schtasks.exe
2872	schtasks.exe

pid	process
936	Jens Frodesen CV.exe
936	Jens Frodesen CV.exe
936	Jens Frodesen CV.exe
936	Jens Frodesen CV.exe
936	Jens Frodesen CV.exe
936	Jens Frodesen CV.exe

pid	process
936	Jens Frodesen CV.exe

description	pid	process
Token: SeDebugPrivilege	936	Jens Frodesen CV.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Jens Frodesen CV.exeJens Frodesen CV.exe

description	pid	process	target process
PID 2672 wrote to memory of 2872	2672	Jens Frodesen CV.exe	schtasks.exe
PID 2672 wrote to memory of 2872	2672	Jens Frodesen CV.exe	schtasks.exe
PID 2672 wrote to memory of 2872	2672	Jens Frodesen CV.exe	schtasks.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 2672 wrote to memory of 936	2672	Jens Frodesen CV.exe	Jens Frodesen CV.exe
PID 936 wrote to memory of 3848	936	Jens Frodesen CV.exe	schtasks.exe
PID 936 wrote to memory of 3848	936	Jens Frodesen CV.exe	schtasks.exe
PID 936 wrote to memory of 3848	936	Jens Frodesen CV.exe	schtasks.exe
PID 936 wrote to memory of 3872	936	Jens Frodesen CV.exe	schtasks.exe
PID 936 wrote to memory of 3872	936	Jens Frodesen CV.exe	schtasks.exe
PID 936 wrote to memory of 3872	936	Jens Frodesen CV.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Jens Frodesen CV.exe
"C:\Users\Admin\AppData\Local\Temp\Jens Frodesen CV.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LrSEeB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD73A.tmp"
2⤵
- Creates scheduled task(s)
PID:2872

C:\Users\Admin\AppData\Local\Temp\Jens Frodesen CV.exe
"{path}"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDBDE.tmp"
3⤵
- Creates scheduled task(s)
PID:3848

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDC1D.tmp"
3⤵
- Creates scheduled task(s)
PID:3872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Jens Frodesen CV.exe.log
Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD73A.tmp
Filesize
1KB

MD5
1087fa61fdb26bd7ef54cf662766a288

SHA1
942928e758719da3cbb76b5b9b1883b2cd89d2a7

SHA256
66c31ceed42c9ebd47769ae2964f15418cbc082eae81e9b8c57d7a7a8b619400

SHA512
63384ddacbd53439e5808ec65901530732cd2bb6a7c304d7dc0bfc13684576a291d3968a1b166f79686547ddd304c7a33a635ff2d84b4a0ca64b63a4eabcbc3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDBDE.tmp
Filesize
1KB

MD5
e1dd6e2c29777a6d5ca9e987132bdccc

SHA1
7a66c0cf1100262f6c3a73c34be1f9dfa2a6a132

SHA256
bd83ad0c63f039703d45a8a3650784d3d4ee9edd2f90c2219f8bedb56e095884

SHA512
e876049e62c7c430f3f6cb8f2684b5883172aa75c6214683c59f91b843b64f1b35bdf19b4acec3413cc7a2ae7543b68d44fb51f5f5c3dc6bf843a18c0ea1db96

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDC1D.tmp
Filesize
1KB

MD5
2271642ca970891700e3f48439739ed8

SHA1
cd472df2349f7db9e1e460d0ee28acd97b8a8793

SHA256
7aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68

SHA512
4669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807

Download Submit
memory/936-140-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/936-139-0x0000000000000000-mapping.dmp

Download
memory/936-146-0x00000000074D0000-0x0000000007536000-memory.dmp

Filesize
408KB

Download
memory/2672-132-0x00000000008D0000-0x00000000009D6000-memory.dmp

Filesize
1.0MB

Download
memory/2672-134-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/2672-133-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/2672-136-0x0000000005360000-0x000000000536A000-memory.dmp

Filesize
40KB

Download
memory/2672-135-0x0000000005480000-0x000000000551C000-memory.dmp

Filesize
624KB

Download
memory/2872-137-0x0000000000000000-mapping.dmp

Download
memory/3848-142-0x0000000000000000-mapping.dmp

Download
memory/3872-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads