nanocore | f360431bc55ce6bbbd77f26a9bcb86b6267c3b82220d06ee4c67b44be2273735

General

Target

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
Size

1.1MB
MD5

c5ca6bf1a4d668abae8a1bd58da7fa89
SHA1

1fb0c57d1ea566b703be21a5dd2334166f5a918e
SHA256

f360431bc55ce6bbbd77f26a9bcb86b6267c3b82220d06ee4c67b44be2273735
SHA512

18401e658d3d97a845d8ed05a750eb702337d9c4e1d25ccedc5a6024beb09cc333668c6f16a60e11523e79908dcd5d7d439a396724b9d5329d44648f6996fdc7
SSDEEP

24576:LrArSrrSV1DCOzMFd1bFfxR6ImZlNRU3jrx:OV/+9fxAXU

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

godisgood1.hopto.org:7712

185.225.73.164:7712

Mutex

bcd7727e-ef56-4958-8ed9-949f5c5ea8f6

Attributes

activate_away_mode
true
backup_connection_host
185.225.73.164
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-05-24T09:37:49.129028236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7712
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
bcd7727e-ef56-4958-8ed9-949f5c5ea8f6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
godisgood1.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe"	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

description	pid	process	target process
PID 4092 set thread context of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Drops file in Program Files directory 2 IoCs

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

description	ioc	process
File created	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
File opened for modification	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4808 schtasks.exe
1248 schtasks.exe
3664 schtasks.exe

pid	process
4808	schtasks.exe
1248	schtasks.exe
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exeAPPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

pid	process
4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

pid process

3392 APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

pid	process
3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exeAPPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

description	pid	process
Token: SeDebugPrivilege	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
Token: SeDebugPrivilege	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exeAPPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe

C:\Users\Admin\AppData\Local\Temp\APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
"C:\Users\Admin\AppData\Local\Temp\APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JLsbuY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2DE6.tmp"
2⤵
- Creates scheduled task(s)
PID:3664

C:\Users\Admin\AppData\Local\Temp\APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
"{path}"
2⤵
PID:1036

C:\Users\Admin\AppData\Local\Temp\APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
"{path}"
2⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
"{path}"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp322C.tmp"
3⤵
- Creates scheduled task(s)
PID:4808

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp327B.tmp"
3⤵
- Creates scheduled task(s)
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2DE6.tmp
Filesize
1KB

MD5
383f936331440721ffc0a16b96ef4d96

SHA1
ab894b85c65d8f7d8908cf6fcb0bfca24eb58860

SHA256
882b7d526359a8bace5bafdadd44e332277d4eb038c8f6b5563debe8f58f26a6

SHA512
f8384fa798d2b07481fa428c8e1e1d6f2b8e72eb39c4777f4e6497dc236538ac8c7ad9d4543a402df1e0abb7b7b8ee665f81e13aa45099cc9102f81fa466ca55

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp322C.tmp
Filesize
1KB

MD5
756e3c36fb9bc5a04c39328c911ba30d

SHA1
e65ff9b79e4e999f693a5d9201b15f90311310f5

SHA256
2296c400d5ac0337a720eb0853eec50082b8372e9f8d36ea9705facf03c67e22

SHA512
273aa5a878fee132469c399a369d902aad47ec7a7c2157c8dbfc58b710d525a466d2990f85aaa23bdcb0ef0abaceeb22f3577632a76fbd1aedcd65174da7bcce

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp327B.tmp
Filesize
1KB

MD5
2f26d92c1eeead3896820e56ec46f6f1

SHA1
d95533b61eed7d89e4ada56bc566d60e42ac1f61

SHA256
99a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa

SHA512
6c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892

Download Submit
memory/1036-139-0x0000000000000000-mapping.dmp

Download
memory/1248-145-0x0000000000000000-mapping.dmp

Download
memory/2244-140-0x0000000000000000-mapping.dmp

Download
memory/3392-141-0x0000000000000000-mapping.dmp

Download
memory/3392-142-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3392-147-0x0000000006D80000-0x0000000006DE6000-memory.dmp

Filesize
408KB

Download
memory/3664-137-0x0000000000000000-mapping.dmp

Download
memory/4092-136-0x0000000005330000-0x000000000533A000-memory.dmp

Filesize
40KB

Download
memory/4092-132-0x00000000007D0000-0x00000000008F8000-memory.dmp

Filesize
1.2MB

Download
memory/4092-135-0x00000000053F0000-0x000000000548C000-memory.dmp

Filesize
624KB

Download
memory/4092-134-0x0000000005280000-0x0000000005312000-memory.dmp

Filesize
584KB

Download
memory/4092-133-0x0000000005900000-0x0000000005EA4000-memory.dmp

Filesize
5.6MB

Download
memory/4808-143-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 4092 wrote to memory of 3664	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 4092 wrote to memory of 3664	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 4092 wrote to memory of 3664	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 4092 wrote to memory of 1036	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 1036	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 1036	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 2244	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 2244	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 2244	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 4092 wrote to memory of 3392	4092	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe
PID 3392 wrote to memory of 4808	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 3392 wrote to memory of 4808	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 3392 wrote to memory of 4808	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 3392 wrote to memory of 1248	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 3392 wrote to memory of 1248	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe
PID 3392 wrote to memory of 1248	3392	APPLICATION FORM MASTER SDPO Brilinskiy NEW U.exe	schtasks.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads