nanocore | 6f0b29e1f172a795c85410a25f9fa349c943dbaa895c90450582e84f9af503be

General

Target

Requisition order,pdf.exe
Size

1.1MB
MD5

79ff06b1665614b22e360abc6009d70c
SHA1

44f3f56d6b85d64af4e4eaa597a475d02d3a7995
SHA256

421388c575a028ab0f8c6566d28d2211d20dbd8f25120105ca97495335f19bf6
SHA512

0e7b36fb3b76316eb3c1cc6d7fc3d98026a085927cd7365b1f6f243d27aaae706624aa5b2c8262219ace491cb911ee2695cf7708e5435e660f63af0814954be9
SSDEEP

12288:Aq8OHhzXaOETMeMeSj5waWZZi+TsqBpp5haIkwSfeKa9HMIz+dchHarUCNV:MOxXaOETvMDj51WhbB/OebsIzcq6AMV

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

zechlli82.ddns.net:7691

79.134.225.75:7691

Mutex

03806af7-5b83-4483-8918-3b672fe4cd7e

Attributes

activate_away_mode
true
backup_connection_host
79.134.225.75
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-25T11:19:23.034676636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7691
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
03806af7-5b83-4483-8918-3b672fe4cd7e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
zechlli82.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Requisition order,pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe"	Requisition order,pdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Requisition order,pdf.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Requisition order,pdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Requisition order,pdf.exe

description pid process target process

PID 1556 set thread context of 488 1556 Requisition order,pdf.exe Requisition order,pdf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Requisition order,pdf.exe

description	pid	process	target process
PID 1556 set thread context of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe

Drops file in Program Files directory 2 IoCs

Processes:

Requisition order,pdf.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	Requisition order,pdf.exe
File opened for modification	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	Requisition order,pdf.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3256 schtasks.exe
2352 schtasks.exe

pid	process
3256	schtasks.exe
2352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Requisition order,pdf.exeRequisition order,pdf.exe

pid	process
1556	Requisition order,pdf.exe
1556	Requisition order,pdf.exe
1556	Requisition order,pdf.exe
1556	Requisition order,pdf.exe
1556	Requisition order,pdf.exe
1556	Requisition order,pdf.exe
1556	Requisition order,pdf.exe
488	Requisition order,pdf.exe
488	Requisition order,pdf.exe
488	Requisition order,pdf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Requisition order,pdf.exe

pid process

488 Requisition order,pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Requisition order,pdf.exeRequisition order,pdf.exe

description pid process

Token: SeDebugPrivilege 1556 Requisition order,pdf.exe
Token: SeDebugPrivilege 488 Requisition order,pdf.exe

pid	process
488	Requisition order,pdf.exe

description	pid	process
Token: SeDebugPrivilege	1556	Requisition order,pdf.exe
Token: SeDebugPrivilege	488	Requisition order,pdf.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Requisition order,pdf.exeRequisition order,pdf.exe

description	pid	process	target process
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1556 wrote to memory of 488	1556	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 488 wrote to memory of 3256	488	Requisition order,pdf.exe	schtasks.exe
PID 488 wrote to memory of 3256	488	Requisition order,pdf.exe	schtasks.exe
PID 488 wrote to memory of 3256	488	Requisition order,pdf.exe	schtasks.exe
PID 488 wrote to memory of 2352	488	Requisition order,pdf.exe	schtasks.exe
PID 488 wrote to memory of 2352	488	Requisition order,pdf.exe	schtasks.exe
PID 488 wrote to memory of 2352	488	Requisition order,pdf.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1112.tmp"
3⤵
- Creates scheduled task(s)
PID:3256

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp15F5.tmp"
3⤵
- Creates scheduled task(s)
PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1112.tmp

Filesize
1KB

MD5
8414aadf594419ba0aca602563121ea9

SHA1
a53cbf93db991c6331aa89f64d0c9de05b672364

SHA256
465f99eb510cf9b16cc47e80dba990ed219555b8f3c56904b4231d9d0cd965fc

SHA512
ff3e3a1c804e784bd1ee726d0380e5f22d87992573389290154cff4eba024e658b3ae92982963f384bb1f6b31b612f1b033fc94addaf00384f53b2e53096cc6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15F5.tmp

Filesize
1KB

MD5
677848190631e19222304d1982aa2e1b

SHA1
bed6cf97d3458e4ea59ff9823375d915a9b3d682

SHA256
8bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d

SHA512
f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e

Download Submit
memory/488-134-0x0000000000000000-mapping.dmp

Download
memory/488-135-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/488-136-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/488-142-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/1556-132-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/1556-133-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/1556-137-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/2352-140-0x0000000000000000-mapping.dmp

Download
memory/3256-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads