nanocore | ff993bd563d3c5c4a78d72ed8d1ab42aa6db6f65be46350e78bfbcbdeab808ad

Analysis

max time kernel
47s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe
Size 365KB
Sample221121-d77tlabf93
SHA256 ff993bd563d3c5c4a78d72ed8d1ab42aa6db6f65be46350e78bfbcbdeab808ad
MD5 52155d7d32ade3e6a24442216858ed4d
SHA1 ebbbb9fc3f0363bf35d0ef19004df307d4782c59
SHA512 51375e91f2143de45545fad2f0394278e13c5c48b2d31b6dc8576d46dce8044cc04f62f4b39294c32545b4065ae1bd56c57337672b9851f567eea1eacc3b3f47
SSDEEP 6144:4Ea0gAWirTWz2I63x2CpkZlQzRQiT7zkwYVL4fn+CdL+uwbbDF82Z2OQ:WAWifgUB260lQzswY5enHN+rx82ZfQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

nanomalay23.hopto.org:6932

Mutex

6bd890d1-3408-4922-8966-5f83f82f18cb

Attributes

activate_away_mode
true
backup_connection_host
nanomalay23.hopto.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-08-28T04:28:03.334276736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6932
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
6bd890d1-3408-4922-8966-5f83f82f18cb
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
1860	qqfoehwh.exe
1940	qqfoehwh.exe

Loads dropped DLL 2 IoCs

pid	Process
1184	SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe
1860	qqfoehwh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\srybyunu = "C:\\Users\\Admin\\AppData\\Roaming\\cqyrsfitbbjac\\fncej.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\qqfoehwh.exe\" C:\\Users\\Admin\\AppData\\Loc"	qqfoehwh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	qqfoehwh.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qqfoehwh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 1940	1860	qqfoehwh.exe	27

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	qqfoehwh.exe
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	qqfoehwh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1492	schtasks.exe
1112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1940	qqfoehwh.exe
1940	qqfoehwh.exe
1940	qqfoehwh.exe
1940	qqfoehwh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	qqfoehwh.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1860	qqfoehwh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	qqfoehwh.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1860	1184	SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe	26
PID 1184 wrote to memory of 1860	1184	SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe	26
PID 1184 wrote to memory of 1860	1184	SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe	26
PID 1184 wrote to memory of 1860	1184	SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe	26
PID 1860 wrote to memory of 1940	1860	qqfoehwh.exe	27
PID 1860 wrote to memory of 1940	1860	qqfoehwh.exe	27
PID 1860 wrote to memory of 1940	1860	qqfoehwh.exe	27
PID 1860 wrote to memory of 1940	1860	qqfoehwh.exe	27
PID 1860 wrote to memory of 1940	1860	qqfoehwh.exe	27
PID 1940 wrote to memory of 1492	1940	qqfoehwh.exe	28
PID 1940 wrote to memory of 1492	1940	qqfoehwh.exe	28
PID 1940 wrote to memory of 1492	1940	qqfoehwh.exe	28
PID 1940 wrote to memory of 1492	1940	qqfoehwh.exe	28
PID 1940 wrote to memory of 1112	1940	qqfoehwh.exe	30
PID 1940 wrote to memory of 1112	1940	qqfoehwh.exe	30
PID 1940 wrote to memory of 1112	1940	qqfoehwh.exe	30
PID 1940 wrote to memory of 1112	1940	qqfoehwh.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9896.10663.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe
  "C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe" C:\Users\Admin\AppData\Local\Temp\kforuzf.d
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe
    "C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe" C:\Users\Admin\AppData\Local\Temp\kforuzf.d
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4EFB.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1492
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp515D.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kforuzf.d

Path C:\Users\Admin\AppData\Local\Temp\kforuzf.d
Size 7KB
SHA256 17f547843d830566402cab0e745ebbdeb8e682daf6029d721468a47221060bde
MD5 222beededa4d3e59c35de71eb4797e5e
SHA1 f9bd0403210467e2ab8629ddded5f3db741a38cd
SHA512 a4c49f102e793c1c154914092fb1a1df138014046e7bc95d4472b39c3fddf95feef3560990500cd0aae97a3df9d510b921c20b117e75b31d670aab31cb37606d
SSDEEP 192:CPP+CwleckcSkKOByLpxTVEqzlGgNRa89OAJxz:M+CwleckclKZLfKqzlRZ9OqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqfoehwh.exe

Path C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe
Size 92KB
SHA256 eff6172c28dff4ea9fa159f00210690603e764759642bf9c1e850962bd703768
MD5 c689cc99d5334d17b11431584cc2e70e
SHA1 d9f6926656c7ef69c5a3337020c72d171bd50d51
SHA512 b2d04a91f22df692016f7bd82ae5a549b537875c59a146f7e5fdf1cb86e86681823893a76aa69fd55d18a3c1dde57c72946591cf2552e2c9af1704a306538dac
SSDEEP 1536:tR2Yusv+xW7qnnr273ovSijPMEGmQCDBEMxi4NJr6073W2on5PVW34msWZcd0Rvl:rRor273WzhDCMxi70i2on5P434/0BIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqfoehwh.exe

Path C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe
Size 92KB
SHA256 eff6172c28dff4ea9fa159f00210690603e764759642bf9c1e850962bd703768
MD5 c689cc99d5334d17b11431584cc2e70e
SHA1 d9f6926656c7ef69c5a3337020c72d171bd50d51
SHA512 b2d04a91f22df692016f7bd82ae5a549b537875c59a146f7e5fdf1cb86e86681823893a76aa69fd55d18a3c1dde57c72946591cf2552e2c9af1704a306538dac
SSDEEP 1536:tR2Yusv+xW7qnnr273ovSijPMEGmQCDBEMxi4NJr6073W2on5PVW34msWZcd0Rvl:rRor273WzhDCMxi70i2on5P434/0BIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqfoehwh.exe

Path C:\Users\Admin\AppData\Local\Temp\qqfoehwh.exe
Size 92KB
SHA256 eff6172c28dff4ea9fa159f00210690603e764759642bf9c1e850962bd703768
MD5 c689cc99d5334d17b11431584cc2e70e
SHA1 d9f6926656c7ef69c5a3337020c72d171bd50d51
SHA512 b2d04a91f22df692016f7bd82ae5a549b537875c59a146f7e5fdf1cb86e86681823893a76aa69fd55d18a3c1dde57c72946591cf2552e2c9af1704a306538dac
SSDEEP 1536:tR2Yusv+xW7qnnr273ovSijPMEGmQCDBEMxi4NJr6073W2on5PVW34msWZcd0Rvl:rRor273WzhDCMxi70i2on5P434/0BIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

srisk.fn

Path C:\Users\Admin\AppData\Local\Temp\srisk.fn
Size 281KB
SHA256 402b487bb9c3be233bbd71874c5a4c3df4151178622648b634b06b7f379d69e7
MD5 c7490acacbbfdc37a4166cfb75f91be4
SHA1 762eb26aef9c1f94000585c6a51530363d3de85a
SHA512 1f5ac43b5690719466150b58fad72eea619ac905ccc272969453a3f003bb29d1deb4d695b6b79f0d6e59e2940deb6c0cdbde78cebf64bd0ecc7a8d788a5443c7
SSDEEP 6144:/FpgUauZKcaJYlcvAJpBK2qO/rwOO/5s4ORCq+79Q7:/AjupcAJpBKlO/8LVORCqK9Q7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4EFB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4EFB.tmp
Size 1KB
SHA256 2f7bfcac4f3eb7acea40d922c8464f80ad5d43127bbe4fdaf9ee46bfbdce915f
MD5 d7f0480d41bdd273e446d6bd965032e5
SHA1 0370cf62a267dcb6a21a5b73468992c4f813121f
SHA512 f95153b0b613144e56c93eb49b21d41d70ec3a9538cefa5693e86b37b0672875c990f031f8433200a955c163447e0eb9e4a2d7c73459fdf8d6cd32954022e298
MD5 SHA1 SHA512

Submit Download

tmp515D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp515D.tmp
Size 1KB
SHA256 38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
MD5 0a24db62cb5b84309c4803346caaa25d
SHA1 67660778f61bb44168c33ed3fe56ed86cf9583e8
SHA512 d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
MD5 SHA1 SHA512

Submit Download

qqfoehwh.exe

Path \Users\Admin\AppData\Local\Temp\qqfoehwh.exe
Size 92KB
SHA256 eff6172c28dff4ea9fa159f00210690603e764759642bf9c1e850962bd703768
MD5 c689cc99d5334d17b11431584cc2e70e
SHA1 d9f6926656c7ef69c5a3337020c72d171bd50d51
SHA512 b2d04a91f22df692016f7bd82ae5a549b537875c59a146f7e5fdf1cb86e86681823893a76aa69fd55d18a3c1dde57c72946591cf2552e2c9af1704a306538dac
SSDEEP 1536:tR2Yusv+xW7qnnr273ovSijPMEGmQCDBEMxi4NJr6073W2on5PVW34msWZcd0Rvl:rRor273WzhDCMxi70i2on5P434/0BIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqfoehwh.exe

Path \Users\Admin\AppData\Local\Temp\qqfoehwh.exe
Size 92KB
SHA256 eff6172c28dff4ea9fa159f00210690603e764759642bf9c1e850962bd703768
MD5 c689cc99d5334d17b11431584cc2e70e
SHA1 d9f6926656c7ef69c5a3337020c72d171bd50d51
SHA512 b2d04a91f22df692016f7bd82ae5a549b537875c59a146f7e5fdf1cb86e86681823893a76aa69fd55d18a3c1dde57c72946591cf2552e2c9af1704a306538dac
SSDEEP 1536:tR2Yusv+xW7qnnr273ovSijPMEGmQCDBEMxi4NJr6073W2on5PVW34msWZcd0Rvl:rRor273WzhDCMxi70i2on5P434/0BIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Download

memory/1940-76-0x00000000051C0000-0x00000000051DA000-memory.dmp

Download

memory/1940-78-0x0000000005200000-0x0000000005212000-memory.dmp

Download

memory/1940-67-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/1940-72-0x0000000002040000-0x000000000204A000-memory.dmp

Download

memory/1940-73-0x0000000004910000-0x000000000492E000-memory.dmp

Download

memory/1940-74-0x0000000004470000-0x000000000447A000-memory.dmp

Download

memory/1940-75-0x00000000050F0000-0x0000000005102000-memory.dmp

Download

memory/1940-66-0x00000000044D0000-0x0000000004508000-memory.dmp

Download

memory/1940-77-0x00000000051F0000-0x00000000051FE000-memory.dmp

Download

memory/1940-79-0x0000000005260000-0x000000000526E000-memory.dmp

Download

memory/1940-80-0x0000000005270000-0x000000000527C000-memory.dmp

Download

memory/1940-81-0x0000000005280000-0x0000000005294000-memory.dmp

Download

memory/1940-82-0x0000000005290000-0x00000000052A0000-memory.dmp

Download

memory/1940-83-0x00000000052A0000-0x00000000052B4000-memory.dmp

Download

memory/1940-84-0x00000000055F0000-0x00000000055FE000-memory.dmp

Download

memory/1940-85-0x0000000005610000-0x000000000563E000-memory.dmp

Download

memory/1940-86-0x0000000005640000-0x0000000005654000-memory.dmp

Download