nanocore | 4b824d25dcbeab6362ef6b3900bada6bb9580973749cba8291a8c9816fc9bdbc

Analysis

max time kernel
109s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
Size

936KB
MD5

b2a8c4a2dd041f92d259c02e924a3a4b
SHA1

50022b4f5c9112c316f8157d9013af1a35d54e3e
SHA256

8cfba40889bb7635de6a423b965ff717b778f2156df2489ca75fb67581cae5f2
SHA512

bac1445b611c520ef7efda6bc6bc73e95152003d5490050ba151a03f6d8333adf05dc1e553cb5fba96814ecfe62627b5785d61b26b09c5ea3f3863a101f59833
SSDEEP

12288:Qe1IEVkkHZzSX27YBaUw59YXXXSRFwKKbc2SCFybWl5b3R541e:QgCkH9Y27YoZkXXSRKY21QWl5bX41e

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

nonoise.duckdns.org:6060

127.0.0.1:6060

Mutex

e5b96835-fb4b-4c21-b4a5-85acaa364db0

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2022-05-05T17:07:06.186249136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6060
default_group
GREENGAS
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
e5b96835-fb4b-4c21-b4a5-85acaa364db0
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
nonoise.duckdns.org
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	37.235.1.174
Destination IP	37.235.1.177

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe"	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
File opened for modification	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1984	schtasks.exe
1068	schtasks.exe
300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
2012	powershell.exe
1980	powershell.exe
1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2012	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	28
PID 1908 wrote to memory of 2012	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	28
PID 1908 wrote to memory of 2012	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	28
PID 1908 wrote to memory of 2012	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	28
PID 1908 wrote to memory of 1980	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	30
PID 1908 wrote to memory of 1980	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	30
PID 1908 wrote to memory of 1980	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	30
PID 1908 wrote to memory of 1980	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	30
PID 1908 wrote to memory of 1984	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	32
PID 1908 wrote to memory of 1984	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	32
PID 1908 wrote to memory of 1984	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	32
PID 1908 wrote to memory of 1984	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	32
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1908 wrote to memory of 1556	1908	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	34
PID 1556 wrote to memory of 1068	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	36
PID 1556 wrote to memory of 1068	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	36
PID 1556 wrote to memory of 1068	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	36
PID 1556 wrote to memory of 1068	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	36
PID 1556 wrote to memory of 300	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	37
PID 1556 wrote to memory of 300	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	37
PID 1556 wrote to memory of 300	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	37
PID 1556 wrote to memory of 300	1556	SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe	37

C:\Users\Admin\AppData\Local\Temp\SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
"C:\Users\Admin\AppData\Local\Temp\SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BCvgcNSl.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BCvgcNSl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF34.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe
  "C:\Users\Admin\AppData\Local\Temp\SHIPMENT NOTIFICATION- EXPORTERS& IMPORTERS SCHEDULED DATE AVAILABLE..exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB7EB.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBA4C.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAF34.tmp

Filesize
1KB

MD5
47120625c238d209f01e0590f7ae69f7

SHA1
e4606eb9e2e29a943c1d8757b20c969bed520f52

SHA256
6a6c80e0381eac62c2eeede59fccb1ecb711227e2dd2dd4bca810922f9bf5cca

SHA512
e877a13a1bb5a6057f00b5c8f5555a4d554e3648f832fad4fdce164d5c7911006cd038268d757acc62d54cee13bd7749c3d8741b00ba569ce2aeac0d336ddeb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB7EB.tmp

Filesize
1KB

MD5
d9a42885990db553baeeff45a252b8d7

SHA1
9bad8e39f470f0776a689538d91edbaa513109ef

SHA256
4b2b03b9006b5ec2837b45dbcd7a760d070631956dde01e6a618bf2afdc5fce1

SHA512
8229b779a57419ac33815cf8ddc1ec9088c7f5598669ab6eb6c2425e8c76c250e7480f2a3e4d211781ba042683e28f7a69901d228a031e61c6eed462798af8d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBA4C.tmp

Filesize
1KB

MD5
981e126601526eaa5b0ad45c496c4465

SHA1
d610d6a21a8420cc73fcd3e54ddae75a5897b28b

SHA256
11ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527

SHA512
a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
056bb9265524e720ded32138421669c3

SHA1
c7c6551875928b3879ebd9b001cfc8097a2ed0de

SHA256
5287085f678f8bd0aa03d1c8636c8af4b40d7998efb05762bcc11a29f3961525

SHA512
71a21d092497d5259635d9c5be8f0dc7793784f118c3f12599d49b10417246198460a957d73038ef285a57ac81215e259021c74bd59a82af8b0cdf7919227630

Download Submit
memory/300-83-0x0000000000000000-mapping.dmp

Download
memory/1068-81-0x0000000000000000-mapping.dmp

Download
memory/1556-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-78-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1556-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-87-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1556-71-0x000000000041E792-mapping.dmp

Download
memory/1556-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1908-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1908-77-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1908-56-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1908-55-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-80-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-59-0x0000000000000000-mapping.dmp

Download
memory/1980-85-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-60-0x0000000000000000-mapping.dmp

Download
memory/2012-79-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-57-0x0000000000000000-mapping.dmp

Download
memory/2012-86-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download