nanocore | e0b3c7281dd3488df3c71ee35dde8fe321e5aae4d3f200d2f63dfef64a97daff

General

Target

attached PI.exe
Size

1.1MB
MD5

238b41e834f3b663584d4788493bc75f
SHA1

006efa65c3a4c5b4ee2402ab5e6d789fc95e0b9c
SHA256

e0b3c7281dd3488df3c71ee35dde8fe321e5aae4d3f200d2f63dfef64a97daff
SHA512

23a862d13b143d37328e8055d99329e0ec5caaa0a554706eb18ad3e0ac298bb5e10141f9101019223bfe77f2abcadfe90e27b91a453c5cf6cb8fe37396af956d
SSDEEP

12288:c3mY2iNw0+9MKvADqjJ5nr9fAn/CoE2g++sn3Qwon89AGPEAbVNqPKvmvuoZ2aVc:c3x1Ieyjrrm/C72g2QFnE7P5

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

brightnano1.ddns.net:1989

171.22.30.97:1989

Mutex

fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe

Attributes

activate_away_mode
true
backup_connection_host
171.22.30.97
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-10T14:34:05.030247036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1989
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
fba1bbc6-2cc8-4c94-b6c0-dda5a12fd7fe
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
brightnano1.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

attached PI.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Manager = "C:\\Program Files (x86)\\AGP Manager\\agpmgr.exe"	attached PI.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

attached PI.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA attached PI.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

attached PI.exe

description pid process target process

PID 1744 set thread context of 268 1744 attached PI.exe attached PI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	attached PI.exe

description	pid	process	target process
PID 1744 set thread context of 268	1744	attached PI.exe	attached PI.exe

Drops file in Program Files directory 2 IoCs

Processes:

attached PI.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Manager\agpmgr.exe	attached PI.exe
File opened for modification	C:\Program Files (x86)\AGP Manager\agpmgr.exe	attached PI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

764 schtasks.exe
1500 schtasks.exe
1552 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

attached PI.exeattached PI.exe

pid process

1744 attached PI.exe
268 attached PI.exe
268 attached PI.exe
268 attached PI.exe
268 attached PI.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

attached PI.exe

pid process

268 attached PI.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

attached PI.exeattached PI.exe

description pid process

Token: SeDebugPrivilege 1744 attached PI.exe
Token: SeDebugPrivilege 268 attached PI.exe

pid	process
764	schtasks.exe
1500	schtasks.exe
1552	schtasks.exe

pid	process
1744	attached PI.exe
268	attached PI.exe
268	attached PI.exe
268	attached PI.exe
268	attached PI.exe

pid	process
268	attached PI.exe

description	pid	process
Token: SeDebugPrivilege	1744	attached PI.exe
Token: SeDebugPrivilege	268	attached PI.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

attached PI.exeattached PI.exe

description	pid	process	target process
PID 1744 wrote to memory of 764	1744	attached PI.exe	schtasks.exe
PID 1744 wrote to memory of 764	1744	attached PI.exe	schtasks.exe
PID 1744 wrote to memory of 764	1744	attached PI.exe	schtasks.exe
PID 1744 wrote to memory of 764	1744	attached PI.exe	schtasks.exe
PID 1744 wrote to memory of 360	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 360	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 360	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 360	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 1744 wrote to memory of 268	1744	attached PI.exe	attached PI.exe
PID 268 wrote to memory of 1500	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1500	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1500	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1500	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1552	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1552	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1552	268	attached PI.exe	schtasks.exe
PID 268 wrote to memory of 1552	268	attached PI.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\attached PI.exe
"C:\Users\Admin\AppData\Local\Temp\attached PI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ecCUXmnB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76F5.tmp"
2⤵
- Creates scheduled task(s)
PID:764

C:\Users\Admin\AppData\Local\Temp\attached PI.exe
"{path}"
2⤵
PID:360

C:\Users\Admin\AppData\Local\Temp\attached PI.exe
"{path}"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7B29.tmp"
3⤵
- Creates scheduled task(s)
PID:1500

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7BE6.tmp"
3⤵
- Creates scheduled task(s)
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp76F5.tmp
Filesize
1KB

MD5
8bfe545690c75ffd450caa30dbfb0afa

SHA1
c2b216aa7de37b5805f9b4532c6a84c14de9e123

SHA256
0cb3ad41c4067165979cab8f719a5b3fb600c2dfc934cb79141307354afe9cb7

SHA512
1f27334e29d7d1cc7b3e437f42f8ebeecb67f12e6fe8e18b51087e87fe18a4abd97817488e4f74a94570d332465d8e6a19e14ec8f6b45f43200332a9b22a7e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7B29.tmp
Filesize
1KB

MD5
d972ae1e12347e96f6777c07e092f28c

SHA1
dc26b4d6a4d7a860fd0cdf7e03a1ea7459fc289b

SHA256
4d80f0dcb044aa6276a43d60b6ffcbf5128bdcf46d5366fa4cc9bbecc6a94a7c

SHA512
2670e29df8104d858cd88d011687511db702135100fdd66ffffa1600a67dbaad656950b178d393246ab63f67920c0293bb1632fa5a355d1471eecb1b6c510720

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7BE6.tmp
Filesize
1KB

MD5
885d6dd30570594e167fadb59d9ca0ea

SHA1
9981e583644c4eb9cf5056615a0e1c2913c8983b

SHA256
7155bc082d1713d77c2797575ee0ade8467fb7012f5376c1d6f4aa618141a7d2

SHA512
1623218143c2c25a7c85fa9da8e0f251f04a5eb848c4d0aa10bfb78688518b82393a2b3c7f287a9dc06a366ef9f46d0d4e2d246ad4cef4554a74c0bb6ff9dd2a

Download Submit
memory/268-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-92-0x0000000000CA0000-0x0000000000CB4000-memory.dmp

Filesize
80KB

Download
memory/268-91-0x00000000009D0000-0x00000000009FE000-memory.dmp

Filesize
184KB

Download
memory/268-90-0x0000000000970000-0x000000000097E000-memory.dmp

Filesize
56KB

Download
memory/268-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-89-0x0000000000960000-0x0000000000974000-memory.dmp

Filesize
80KB

Download
memory/268-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-68-0x000000000041E792-mapping.dmp

Download
memory/268-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/268-88-0x0000000000770000-0x0000000000780000-memory.dmp

Filesize
64KB

Download
memory/268-87-0x0000000000760000-0x0000000000774000-memory.dmp

Filesize
80KB

Download
memory/268-86-0x0000000000740000-0x000000000074C000-memory.dmp

Filesize
48KB

Download
memory/268-78-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/268-85-0x0000000000730000-0x000000000073E000-memory.dmp

Filesize
56KB

Download
memory/268-79-0x0000000000620000-0x000000000063E000-memory.dmp

Filesize
120KB

Download
memory/268-80-0x0000000000530000-0x000000000053A000-memory.dmp

Filesize
40KB

Download
memory/268-81-0x0000000000680000-0x0000000000692000-memory.dmp

Filesize
72KB

Download
memory/268-82-0x0000000000690000-0x00000000006AA000-memory.dmp

Filesize
104KB

Download
memory/268-83-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/268-84-0x0000000000720000-0x0000000000732000-memory.dmp

Filesize
72KB

Download
memory/764-59-0x0000000000000000-mapping.dmp

Download
memory/1500-74-0x0000000000000000-mapping.dmp

Download
memory/1552-76-0x0000000000000000-mapping.dmp

Download
memory/1744-58-0x0000000000A30000-0x0000000000A6A000-memory.dmp

Filesize
232KB

Download
memory/1744-56-0x00000000004B0000-0x00000000004D0000-memory.dmp

Filesize
128KB

Download
memory/1744-54-0x0000000000CB0000-0x0000000000DCA000-memory.dmp

Filesize
1.1MB

Download
memory/1744-57-0x0000000005CE0000-0x0000000005D6C000-memory.dmp

Filesize
560KB

Download
memory/1744-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads