nanocore | 0a8def931d63d0725952e49aca0a2b1e95ee51d6ec8f0dbd8aa6e8145e3ee7f0

General

Target

Payment Order.exe
Size

1.0MB
MD5

11711e45cabcdda6408597a44517c9aa
SHA1

087d435882f0fca5b85ab34d981814ea8e5f4bad
SHA256

73e0cfe89cdb7759de8338d0174f721d8ae60539e5ea8f5236548de0513b5054
SHA512

9694cacd6759dfba4fec7cfdd6bdabc6f22edf3d1702dfe61dd4afbda3f1e2e56986873153977f28b29bbde75274231a2e4b555b94e13157bcf84085ea0c63e6
SSDEEP

12288:W8qK4HTNcD9wIZbySXVNrY9oJ2UfDRqKgUm4KR2YQqwMd1ndT:WMD9jXXRDcym4g2YQ6vT

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

tochi.ddns.net:1177

127.0.0.1:1177

Mutex

5640475c-30f6-4f19-b86f-d53c3910bce7

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2022-07-02T08:25:26.509790436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1177
default_group
money transfer
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
5640475c-30f6-4f19-b86f-d53c3910bce7
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tochi.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Payment Order.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Payment Order.exe

Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 37.235.1.177
Destination IP 37.235.1.174
Destination IP 37.235.1.177
Destination IP 37.235.1.174

description	ioc
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Payment Order.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Monitor = "C:\\Program Files (x86)\\AGP Monitor\\agpmon.exe"	Payment Order.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Payment Order.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Payment Order.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Order.exe

description pid process target process

PID 4892 set thread context of 4224 4892 Payment Order.exe Payment Order.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Payment Order.exe

description	pid	process	target process
PID 4892 set thread context of 4224	4892	Payment Order.exe	Payment Order.exe

Drops file in Program Files directory 2 IoCs

Processes:

Payment Order.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Monitor\agpmon.exe	Payment Order.exe
File opened for modification	C:\Program Files (x86)\AGP Monitor\agpmon.exe	Payment Order.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4260 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exePayment Order.exe

pid process

1880 powershell.exe
4224 Payment Order.exe
4224 Payment Order.exe
4224 Payment Order.exe
1880 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Payment Order.exe

pid process

4224 Payment Order.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exePayment Order.exe

description pid process

Token: SeDebugPrivilege 1880 powershell.exe
Token: SeDebugPrivilege 4224 Payment Order.exe

pid	process
4260	schtasks.exe

pid	process
1880	powershell.exe
4224	Payment Order.exe
4224	Payment Order.exe
4224	Payment Order.exe
1880	powershell.exe

pid	process
4224	Payment Order.exe

description	pid	process
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	4224	Payment Order.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Payment Order.exe

description	pid	process	target process
PID 4892 wrote to memory of 1880	4892	Payment Order.exe	powershell.exe
PID 4892 wrote to memory of 1880	4892	Payment Order.exe	powershell.exe
PID 4892 wrote to memory of 1880	4892	Payment Order.exe	powershell.exe
PID 4892 wrote to memory of 4260	4892	Payment Order.exe	schtasks.exe
PID 4892 wrote to memory of 4260	4892	Payment Order.exe	schtasks.exe
PID 4892 wrote to memory of 4260	4892	Payment Order.exe	schtasks.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe
PID 4892 wrote to memory of 4224	4892	Payment Order.exe	Payment Order.exe

C:\Users\Admin\AppData\Local\Temp\Payment Order.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DSjOgD.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DSjOgD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE436.tmp"
2⤵
- Creates scheduled task(s)
PID:4260

C:\Users\Admin\AppData\Local\Temp\Payment Order.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Payment Order.exe.log
Filesize
673B

MD5
a70f4eab0c307df43fba00d5b8dc3812

SHA1
49eea64ec436e38436e94b3dbdc0761156f8fb11

SHA256
24530a8c840eaef5c9d7ca6d9f4124b80fd40b24eb2688b2085e875be349d325

SHA512
7340ce7c58745b1e568147d2abe2bb7df3d699471b6710af0d6d9d37ac3cebbe75b121cb84dddc544e7c42a8999ff798f393aeca657a3b8210b7d04c25435730

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE436.tmp
Filesize
1KB

MD5
8ef907c72d3812a2a9721c7a2223fe9c

SHA1
363fdeb4b502681e14e221119397c7b8b201a34c

SHA256
96052d4e49cc8534e59cb83752a2f5a0828454854b660004e44031ed5598a20c

SHA512
a6c940bf556fe31857d7096ecc33ef2caaa638a40ba7dfad1ee8e8e202cf9b9186caba5734e2031fb203ceb550f68303ef055080413f08a9a56f8d3e3622da98

Download Submit
memory/1880-150-0x000000006F270000-0x000000006F2BC000-memory.dmp

Filesize
304KB

Download
memory/1880-153-0x0000000005B60000-0x0000000005B7A000-memory.dmp

Filesize
104KB

Download
memory/1880-146-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/1880-158-0x0000000007180000-0x0000000007188000-memory.dmp

Filesize
32KB

Download
memory/1880-157-0x00000000071A0000-0x00000000071BA000-memory.dmp

Filesize
104KB

Download
memory/1880-156-0x0000000007090000-0x000000000709E000-memory.dmp

Filesize
56KB

Download
memory/1880-155-0x00000000070E0000-0x0000000007176000-memory.dmp

Filesize
600KB

Download
memory/1880-148-0x0000000004980000-0x000000000499E000-memory.dmp

Filesize
120KB

Download
memory/1880-154-0x0000000006ED0000-0x0000000006EDA000-memory.dmp

Filesize
40KB

Download
memory/1880-142-0x0000000004D20000-0x0000000005348000-memory.dmp

Filesize
6.2MB

Download
memory/1880-144-0x0000000005350000-0x0000000005372000-memory.dmp

Filesize
136KB

Download
memory/1880-145-0x00000000053F0000-0x0000000005456000-memory.dmp

Filesize
408KB

Download
memory/1880-134-0x0000000000000000-mapping.dmp

Download
memory/1880-152-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Filesize
6.5MB

Download
memory/1880-141-0x0000000004600000-0x0000000004636000-memory.dmp

Filesize
216KB

Download
memory/1880-149-0x00000000060F0000-0x0000000006122000-memory.dmp

Filesize
200KB

Download
memory/1880-151-0x0000000006130000-0x000000000614E000-memory.dmp

Filesize
120KB

Download
memory/4224-138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4224-143-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4224-147-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4224-137-0x0000000000000000-mapping.dmp

Download
memory/4260-135-0x0000000000000000-mapping.dmp

Download
memory/4892-132-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4892-140-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4892-133-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads