nanocore | 8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56

General

Target

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
Size

270KB
MD5

830842c2d496a441fd3dd6f3287c3e70
SHA1

3d771b1f4134b64eee5e528a45ac53467357bee7
SHA256

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56
SHA512

7082fd1ecacc471f3307b0235cbef016a59a40f497ed8797efd807218b71a758293b153c87d28b6ccbc03b14fe7e87c7b71db953465fa4bcd44e96332f7a94d2
SSDEEP

6144:BzaQn0nMDe3DMZuwh7qQVFxvVSIqrXTTlfdMv9f7kMRVT:WKe3AZ8QHjmPlfsf77

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.2

C2

new555.ddns.net:9033

Mutex

89e372af-03b6-4ab1-9866-df02d772a035

Attributes

activate_away_mode
true
backup_connection_host
new555.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2015-06-04T12:47:21.331485136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
9033
default_group
JESUS.IGWE
enable_debug_mode
true
gc_threshold
1.0448576e+08
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0448576e+08
mutex
89e372af-03b6-4ab1-9866-df02d772a035
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
new555.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.2
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

sql_support.exe

pid process

876 sql_support.exe

pid	process
876	sql_support.exe

Loads dropped DLL 2 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

pid	process
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exesql_support.exe8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe"	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe"	sql_support.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

description	pid	process	target process
PID 1124 set thread context of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Drops file in Program Files directory 2 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

description	ioc	process
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exesql_support.exe8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

pid	process
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
2032	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
2032	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe
876	sql_support.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
876	sql_support.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

pid process

2032 8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

pid	process
2032	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exesql_support.exe8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

description	pid	process
Token: SeDebugPrivilege	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
Token: SeDebugPrivilege	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
Token: SeDebugPrivilege	876	sql_support.exe
Token: SeDebugPrivilege	2032	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe

description	pid	process	target process
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 2032	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
PID 1124 wrote to memory of 876	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	sql_support.exe
PID 1124 wrote to memory of 876	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	sql_support.exe
PID 1124 wrote to memory of 876	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	sql_support.exe
PID 1124 wrote to memory of 876	1124	8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe	sql_support.exe

C:\Users\Admin\AppData\Local\Temp\8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
"C:\Users\Admin\AppData\Local\Temp\8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe
"C:\Users\Admin\AppData\Local\Temp\8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Users\Admin\AppData\Local\Temp\sql_support.exe
"C:\Users\Admin\AppData\Local\Temp\sql_support.exe" -woohoo 2032 C:\Users\Admin\AppData\Local\Temp\chrome.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\chrome.exe

Filesize
270KB

MD5
830842c2d496a441fd3dd6f3287c3e70

SHA1
3d771b1f4134b64eee5e528a45ac53467357bee7

SHA256
8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56

SHA512
7082fd1ecacc471f3307b0235cbef016a59a40f497ed8797efd807218b71a758293b153c87d28b6ccbc03b14fe7e87c7b71db953465fa4bcd44e96332f7a94d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sql_support.exe

Filesize
270KB

MD5
830842c2d496a441fd3dd6f3287c3e70

SHA1
3d771b1f4134b64eee5e528a45ac53467357bee7

SHA256
8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56

SHA512
7082fd1ecacc471f3307b0235cbef016a59a40f497ed8797efd807218b71a758293b153c87d28b6ccbc03b14fe7e87c7b71db953465fa4bcd44e96332f7a94d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sql_support.exe

Filesize
270KB

MD5
830842c2d496a441fd3dd6f3287c3e70

SHA1
3d771b1f4134b64eee5e528a45ac53467357bee7

SHA256
8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56

SHA512
7082fd1ecacc471f3307b0235cbef016a59a40f497ed8797efd807218b71a758293b153c87d28b6ccbc03b14fe7e87c7b71db953465fa4bcd44e96332f7a94d2

Download Submit
\Users\Admin\AppData\Local\Temp\sql_support.exe

Filesize
270KB

MD5
830842c2d496a441fd3dd6f3287c3e70

SHA1
3d771b1f4134b64eee5e528a45ac53467357bee7

SHA256
8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56

SHA512
7082fd1ecacc471f3307b0235cbef016a59a40f497ed8797efd807218b71a758293b153c87d28b6ccbc03b14fe7e87c7b71db953465fa4bcd44e96332f7a94d2

Download Submit
\Users\Admin\AppData\Local\Temp\sql_support.exe

Filesize
270KB

MD5
830842c2d496a441fd3dd6f3287c3e70

SHA1
3d771b1f4134b64eee5e528a45ac53467357bee7

SHA256
8f657c7d2a017370eb8163a8b0f4cf6b1d8190587731748707645e22de050c56

SHA512
7082fd1ecacc471f3307b0235cbef016a59a40f497ed8797efd807218b71a758293b153c87d28b6ccbc03b14fe7e87c7b71db953465fa4bcd44e96332f7a94d2

Download Submit
memory/876-83-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/876-80-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/876-76-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-56-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/2032-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2032-73-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2032-71-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2032-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2032-67-0x000000000041E73A-mapping.dmp

Download
memory/2032-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2032-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2032-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2032-82-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2032-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads