nanocore | 38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2

General

Target

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe
Size

247KB
MD5

9deae9ea695e8e5fdab35294f848e6b2
SHA1

73314c20de4b46a6ddb5c9b224e22c1c20ef0183
SHA256

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2
SHA512

89b70646c7789b81c029829a47888b93af8033b92665104e0513446b4ca08fb3e04579480a5d00ef50817104742ff747b20c0b03f9ab82d6c8cf5738bf369d76
SSDEEP

6144:6HVBccB9DtCftfZSmijPZtWVbOV9s2W4A375ySgMz0TRn4w:orybOV9ssi5NgM4T

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.0.0

C2

informer.ddns.net:9033

Mutex

f26b04ec-d813-46f5-a7c2-6b8110394025

Attributes

activate_away_mode
true
backup_connection_host
informer.ddns.net
backup_dns_server
buffer_size
65535
build_time
2014-08-13T12:19:06.373609236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9033
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f26b04ec-d813-46f5-a7c2-6b8110394025
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
informer.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.0.0
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\x4c6lpG5\\MGDvRNf.exe,explorer.exe"	reg.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Manager = "C:\\Program Files (x86)\\DSL Manager\\dslmgr.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe

description	pid	process	target process
PID 3104 set thread context of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe

Drops file in Program Files directory 2 IoCs

Processes:

MSBuild.exe

description	ioc	process
File created	C:\Program Files (x86)\DSL Manager\dslmgr.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\DSL Manager\dslmgr.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exeMSBuild.exe

pid	process
3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe
3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe
4996	MSBuild.exe
4996	MSBuild.exe
4996	MSBuild.exe
4996	MSBuild.exe
4996	MSBuild.exe
4996	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

4996 MSBuild.exe

pid	process
4996	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe
Token: SeDebugPrivilege	4996	MSBuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.execmd.exe

description	pid	process	target process
PID 3104 wrote to memory of 3548	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	cmd.exe
PID 3104 wrote to memory of 3548	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	cmd.exe
PID 3104 wrote to memory of 3548	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	cmd.exe
PID 3548 wrote to memory of 1268	3548	cmd.exe	reg.exe
PID 3548 wrote to memory of 1268	3548	cmd.exe	reg.exe
PID 3548 wrote to memory of 1268	3548	cmd.exe	reg.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe
PID 3104 wrote to memory of 4996	3104	38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe
"C:\Users\Admin\AppData\Local\Temp\38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe,explorer.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3548

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe,explorer.exe"
3⤵
- Modifies WinLogon for persistence
PID:1268

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-135-0x0000000000000000-mapping.dmp

Download
memory/3104-132-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/3104-133-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/3104-138-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/3548-134-0x0000000000000000-mapping.dmp

Download
memory/4996-136-0x0000000000000000-mapping.dmp

Download
memory/4996-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4996-139-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/4996-140-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads