nanocore | 9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2022, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
Size 1.0MB
Sample221108-r6fklscec7
SHA256 9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d
MD5 fb450315e25b6badfa3f801d3f565a45
SHA1 cc7b9a71d27e4d08c779355cde5e7052e3c6751b
SHA512 443f84a11798ea9fa6ca48c62f454da35f82381fce12c4d0db1c1878d2ff27167cfc9a67fe16bfc604b687f7cd2775e919bf7078c223559f8c8e7946c5ff498c
SSDEEP 24576:9Z2H491H5GorX3dH2VymMTP0Ojpsdz39:j2Y955Gob3dWV3VOjpw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

deranano.ddns.net:1010
80.76.51.109:1010

Mutex

08765466-ad1b-454f-af1f-45839cebf1d5

Attributes

activate_away_mode
true
backup_connection_host
80.76.51.109
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-31T15:53:28.385104436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1010
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
08765466-ad1b-454f-af1f-45839cebf1d5
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
deranano.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Monitor = "C:\\Program Files (x86)\\AGP Monitor\\agpmon.exe"	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AGP Monitor\agpmon.exe	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
File opened for modification	C:\Program Files (x86)\AGP Monitor\agpmon.exe	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4308	schtasks.exe
4272	schtasks.exe
3232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4308	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	84
PID 3480 wrote to memory of 4308	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	84
PID 3480 wrote to memory of 4308	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	84
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 3480 wrote to memory of 4412	3480	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	86
PID 4412 wrote to memory of 4272	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	87
PID 4412 wrote to memory of 4272	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	87
PID 4412 wrote to memory of 4272	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	87
PID 4412 wrote to memory of 3232	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	89
PID 4412 wrote to memory of 3232	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	89
PID 4412 wrote to memory of 3232	4412	9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe	89

C:\Users\Admin\AppData\Local\Temp\9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
"C:\Users\Admin\AppData\Local\Temp\9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\acGwJnflOF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF13B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "AGP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2A0.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:4272
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "AGP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD01.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9bee8a68af02c8f24fa8d28589633b3060cf7a0af7787f315368a4934e53856d.exe.log
Size 1KB
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
MD5 SHA1 SHA512

Submit Download

tmp2A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp2A0.tmp
Size 1KB
SHA256 3595d2517a5398d937cb7d225d2d12c8f1e87bdb8ab3d0ca70e09c620d19561f
MD5 6801d2d524ec221351e30198923478c3
SHA1 1978fc7ca253139750ef8fa9bb2002c995a4cfa7
SHA512 23abd7750fcb5d039d691172b423a4f813e50e044b94fb9b2c5c0b88584a5fb2d878a2bf0e374986873bb3798ae3a87959b3edf9a0c39e6854ea715522b3a7ab
MD5 SHA1 SHA512

Submit Download

tmpD01.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD01.tmp
Size 1KB
SHA256 49d903f84313feb16bd189c58b6c206f98b05da00ea0da881e2ff0c893b6ba5e
MD5 157cd55403665c49c9fd3ca1196c4397
SHA1 4feed6e606b41bb617274471349582963182756b
SHA512 bea7e3caa9c37cadd772a6d3ee0d9ed47de6b3e880cd58649be2939cacd00f70d4edc1ad177e432539267bb520094d9cda3f781cdfc69122f3775242321c11b8
MD5 SHA1 SHA512

Submit Download

tmpF13B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF13B.tmp
Size 1KB
SHA256 b6eab0794ca9c7dd6814401c953dd3049740084249a2833959bb24ab7ae5940e
MD5 11418127c5d6f1b9067af3efe88bbe9a
SHA1 bc10b3f428c3496f9f973bf45ddd0dffa24f8fb6
SHA512 ca0f7e9265d282251b2f0fdd79d0dad0823ea6064af94e577dd2e6392eecb55e3b6f8b1fdf6b816c34f1761bb8c92ac09a291e1a46c53139b6e51565b6736192
MD5 SHA1 SHA512

Submit Download

memory/3480-136-0x0000000004E50000-0x0000000004E5A000-memory.dmp

Download

memory/3480-132-0x0000000000390000-0x0000000000498000-memory.dmp

Download

memory/3480-135-0x0000000004FA0000-0x000000000503C000-memory.dmp

Download

memory/3480-134-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Download

memory/3480-133-0x0000000005370000-0x0000000005914000-memory.dmp

Download

memory/4412-140-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4412-146-0x0000000007020000-0x0000000007086000-memory.dmp

Download