nanocore | 421388c575a028ab0f8c6566d28d2211d20dbd8f25120105ca97495335f19bf6

General

Target

Requisition order,pdf.exe
Size

1.1MB
MD5

79ff06b1665614b22e360abc6009d70c
SHA1

44f3f56d6b85d64af4e4eaa597a475d02d3a7995
SHA256

421388c575a028ab0f8c6566d28d2211d20dbd8f25120105ca97495335f19bf6
SHA512

0e7b36fb3b76316eb3c1cc6d7fc3d98026a085927cd7365b1f6f243d27aaae706624aa5b2c8262219ace491cb911ee2695cf7708e5435e660f63af0814954be9
SSDEEP

12288:Aq8OHhzXaOETMeMeSj5waWZZi+TsqBpp5haIkwSfeKa9HMIz+dchHarUCNV:MOxXaOETvMDj51WhbB/OebsIzcq6AMV

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

zechlli82.ddns.net:7691

79.134.225.75:7691

Mutex

03806af7-5b83-4483-8918-3b672fe4cd7e

Attributes

activate_away_mode
true
backup_connection_host
79.134.225.75
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-25T11:19:23.034676636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7691
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
03806af7-5b83-4483-8918-3b672fe4cd7e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
zechlli82.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Requisition order,pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Manager = "C:\\Program Files (x86)\\AGP Manager\\agpmgr.exe"	Requisition order,pdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Requisition order,pdf.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Requisition order,pdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Requisition order,pdf.exe

description pid process target process

PID 1288 set thread context of 672 1288 Requisition order,pdf.exe Requisition order,pdf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Requisition order,pdf.exe

description	pid	process	target process
PID 1288 set thread context of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe

Drops file in Program Files directory 2 IoCs

Processes:

Requisition order,pdf.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Manager\agpmgr.exe	Requisition order,pdf.exe
File opened for modification	C:\Program Files (x86)\AGP Manager\agpmgr.exe	Requisition order,pdf.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1980 schtasks.exe
516 schtasks.exe

pid	process
1980	schtasks.exe
516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Requisition order,pdf.exeRequisition order,pdf.exe

pid	process
1288	Requisition order,pdf.exe
1288	Requisition order,pdf.exe
1288	Requisition order,pdf.exe
1288	Requisition order,pdf.exe
1288	Requisition order,pdf.exe
672	Requisition order,pdf.exe
672	Requisition order,pdf.exe
672	Requisition order,pdf.exe
672	Requisition order,pdf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Requisition order,pdf.exe

pid process

672 Requisition order,pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Requisition order,pdf.exeRequisition order,pdf.exe

description pid process

Token: SeDebugPrivilege 1288 Requisition order,pdf.exe
Token: SeDebugPrivilege 672 Requisition order,pdf.exe

pid	process
672	Requisition order,pdf.exe

description	pid	process
Token: SeDebugPrivilege	1288	Requisition order,pdf.exe
Token: SeDebugPrivilege	672	Requisition order,pdf.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Requisition order,pdf.exeRequisition order,pdf.exe

description	pid	process	target process
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 1288 wrote to memory of 672	1288	Requisition order,pdf.exe	Requisition order,pdf.exe
PID 672 wrote to memory of 1980	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 1980	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 1980	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 1980	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 516	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 516	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 516	672	Requisition order,pdf.exe	schtasks.exe
PID 672 wrote to memory of 516	672	Requisition order,pdf.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Requisition order,pdf.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFB12.tmp"
3⤵
- Creates scheduled task(s)
PID:1980

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFC7A.tmp"
3⤵
- Creates scheduled task(s)
PID:516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFB12.tmp

Filesize
1KB

MD5
8414aadf594419ba0aca602563121ea9

SHA1
a53cbf93db991c6331aa89f64d0c9de05b672364

SHA256
465f99eb510cf9b16cc47e80dba990ed219555b8f3c56904b4231d9d0cd965fc

SHA512
ff3e3a1c804e784bd1ee726d0380e5f22d87992573389290154cff4eba024e658b3ae92982963f384bb1f6b31b612f1b033fc94addaf00384f53b2e53096cc6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFC7A.tmp

Filesize
1KB

MD5
885d6dd30570594e167fadb59d9ca0ea

SHA1
9981e583644c4eb9cf5056615a0e1c2913c8983b

SHA256
7155bc082d1713d77c2797575ee0ade8467fb7012f5376c1d6f4aa618141a7d2

SHA512
1623218143c2c25a7c85fa9da8e0f251f04a5eb848c4d0aa10bfb78688518b82393a2b3c7f287a9dc06a366ef9f46d0d4e2d246ad4cef4554a74c0bb6ff9dd2a

Download Submit
memory/516-73-0x0000000000000000-mapping.dmp

Download
memory/672-64-0x000000000041E792-mapping.dmp

Download
memory/672-68-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/672-61-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/672-60-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/672-63-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/672-76-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/672-66-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/672-58-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/672-75-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/672-57-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1288-56-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-55-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-70-0x00000000745E0000-0x0000000074B8B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1980-71-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads