nanocore | 9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d

Analysis

max time kernel
347s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
Size 371KB
Sample221126-hwnc2aba22
SHA256 9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d
MD5 1b40799686c824c63bee08e4a12a2643
SHA1 f3b349f883b64393f67405ba12abd5a413846142
SHA512 109c0e230150ab7d1fe00904cac937accce2a4d7769673338cc0f5c771adca673df031aeee397d86117d018c50d907cf1ea6b905c45df5c2cd28f95f946d845d
SSDEEP 6144:V1jeD5KSYmb9JXMGEg+LnSSqtq5WJdv6l9z4cSoQQHa+LvYTzPE7Xz3FQ:rjeMSPD7+LnSSqoVl9zioQQPYT2Xz1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
buffer_size
0
build_time
0001-01-01T00:00:00Z
bypass_user_account_control
false
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
0
connection_port
0
default_group
enable_debug_mode
false
gc_threshold
0
keep_alive_timeout
0
keyboard_logging
false
lan_timeout
0
max_packet_size
0
mutex
mutex_timeout
0
prevent_system_sleep
false
primary_connection_host
primary_dns_server
request_elevation
false
restart_delay
0
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
0
use_custom_dns_server
false
version
wan_timeout
0

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
3644	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3196 set thread context of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
Token: 33	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
Token: SeIncBasePriorityPrivilege	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4780	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	83
PID 3196 wrote to memory of 4780	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	83
PID 3196 wrote to memory of 4780	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	83
PID 4780 wrote to memory of 3440	4780	cmd.exe	85
PID 4780 wrote to memory of 3440	4780	cmd.exe	85
PID 4780 wrote to memory of 3440	4780	cmd.exe	85
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86
PID 3196 wrote to memory of 3644	3196	9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe	86

C:\Users\Admin\AppData\Local\Temp\9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe
"C:\Users\Admin\AppData\Local\Temp\9c235312c8d1361e89a1536b9f3b61379303b38c0314dfd545ac4691d8bceb2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\svhost\mata.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\svhost\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\svhost\mata2.bat"
    3⤵
    PID:3440
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  C:\Users\Admin\AppData\Local\Temp\svhost.exe
  2⤵
  - Executes dropped EXE
  PID:3644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 52KB
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 52KB
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
MD5 SHA1 SHA512 SSDEEP

Submit Download

invs.vbs

Path C:\Users\Admin\AppData\Local\Temp\svhost\invs.vbs
Size 78B
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
MD5 SHA1 SHA512

Submit Download

mata.bat

Path C:\Users\Admin\AppData\Local\Temp\svhost\mata.bat
Size 62B
SHA256 45fd5110eaac7c01a387afa4ed8ca2b82ba955f493cc6fecf0840c2add6eaca0
MD5 04249a6368c67fcf5c4b1d58b13482a8
SHA1 cabe347cd59dd9491a3d44e682943841456b2f2d
SHA512 a667d05078efb7cfc4d47a563a2b25b63aa1a5a5e3f90cd284233913f102dc9bc65d49dfb1d5ee418361c17992886b569bd22ede4bf8fb6642beb8479ae1f02f
MD5 SHA1 SHA512

Submit Download

memory/3196-132-0x00000000749A0000-0x0000000074F51000-memory.dmp

Download

memory/3196-133-0x00000000749A0000-0x0000000074F51000-memory.dmp

Download

memory/3644-139-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3644-142-0x00000000749A0000-0x0000000074F51000-memory.dmp

Download

memory/3644-143-0x00000000749A0000-0x0000000074F51000-memory.dmp

Download