nanocore | a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c

General

Target

a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
Size

513KB
MD5

d4d8d5561f956ce6152c0bdef9ab0330
SHA1

b3b8f4be8a671c3b24a9dc18055b611e2ba4357d
SHA256

a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c
SHA512

fcb26b648477c71ebb7dd277430f009992fe5d393406cc117c7fa2c08666416f8caad843613866d6a0caf7fd7c524cd34c49e87b6ba28d2d92d6ee1074278521
SSDEEP

12288:737VWUQUXrv6c2Q1JDB1sCbj21Hln4Ye0rXDc:XKUXj6cbJl1DXeln4Z0rXDc

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.1.1

C2

87.231.21.54:4242

192.168.0.18:4242

Mutex

322262ce-9696-4b85-b0b7-24f45dfb3e97

Attributes

activate_away_mode
true
backup_connection_host
192.168.0.18
backup_dns_server
buffer_size
65535
build_time
2014-10-27T20:39:29.987250736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4242
default_group
TheGr8Spread
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
322262ce-9696-4b85-b0b7-24f45dfb3e97
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
87.231.21.54
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.1.1
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wow\\file.exe"	reg.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

notepad .exe

pid process

3636 notepad .exe

pid	process
3636	notepad .exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exea7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

notepad .exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA notepad .exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	notepad .exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe

description	pid	process	target process
PID 428 set thread context of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4960 timeout.exe

pid	process
4960	timeout.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exenotepad .exe

pid	process
428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
3636	notepad .exe
3636	notepad .exe
3636	notepad .exe
428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

notepad .exe

pid process

3636 notepad .exe

pid	process
3636	notepad .exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exenotepad .exe

description	pid	process
Token: SeDebugPrivilege	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
Token: 33	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
Token: SeIncBasePriorityPrivilege	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
Token: SeDebugPrivilege	3636	notepad .exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.execmd.exewscript.execmd.execmd.exe

description	pid	process	target process
PID 428 wrote to memory of 2272	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	cmd.exe
PID 428 wrote to memory of 2272	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	cmd.exe
PID 428 wrote to memory of 2272	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	cmd.exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 2272 wrote to memory of 3640	2272	cmd.exe	wscript.exe
PID 2272 wrote to memory of 3640	2272	cmd.exe	wscript.exe
PID 2272 wrote to memory of 3640	2272	cmd.exe	wscript.exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 428 wrote to memory of 3636	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	notepad .exe
PID 3640 wrote to memory of 3620	3640	wscript.exe	cmd.exe
PID 3640 wrote to memory of 3620	3640	wscript.exe	cmd.exe
PID 3640 wrote to memory of 3620	3640	wscript.exe	cmd.exe
PID 3620 wrote to memory of 4360	3620	cmd.exe	reg.exe
PID 3620 wrote to memory of 4360	3620	cmd.exe	reg.exe
PID 3620 wrote to memory of 4360	3620	cmd.exe	reg.exe
PID 428 wrote to memory of 2616	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	cmd.exe
PID 428 wrote to memory of 2616	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	cmd.exe
PID 428 wrote to memory of 2616	428	a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe	cmd.exe
PID 2616 wrote to memory of 4960	2616	cmd.exe	timeout.exe
PID 2616 wrote to memory of 4960	2616	cmd.exe	timeout.exe
PID 2616 wrote to memory of 4960	2616	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe
"C:\Users\Admin\AppData\Local\Temp\a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\wow\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\wow\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\wow\mata2.bat"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wow\mata2.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wow\file.exe" /f
5⤵
- Modifies WinLogon for persistence
PID:4360

C:\Users\Admin\AppData\Local\Temp\notepad .exe
"C:\Users\Admin\AppData\Local\Temp\notepad .exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wow\notepad.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\timeout.exe
timeout /t 300
3⤵
- Delays execution with timeout.exe
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\notepad .exe
Filesize
52KB

MD5
a64daca3cfbcd039df3ec29d3eddd001

SHA1
eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

SHA256
403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

SHA512
b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad .exe
Filesize
52KB

MD5
a64daca3cfbcd039df3ec29d3eddd001

SHA1
eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

SHA256
403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

SHA512
b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

Download Submit
C:\Users\Admin\AppData\Local\Temp\wow\file.exe
Filesize
513KB

MD5
d4d8d5561f956ce6152c0bdef9ab0330

SHA1
b3b8f4be8a671c3b24a9dc18055b611e2ba4357d

SHA256
a7bc7021fb57ad2b0ee8a75ed7a7a11d5fff57c72ee0be680d1a58fc6262183c

SHA512
fcb26b648477c71ebb7dd277430f009992fe5d393406cc117c7fa2c08666416f8caad843613866d6a0caf7fd7c524cd34c49e87b6ba28d2d92d6ee1074278521

Download Submit
C:\Users\Admin\AppData\Local\Temp\wow\invs.vbs
Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wow\mata.bat
Filesize
56B

MD5
0f428c2415ad312d6f3c2b9a1fc9f832

SHA1
762de8bb44af9ef27a7ab7a9b02fd4a6546d5fc6

SHA256
7fc0b52ca38c4654518ff63ae7adc1d1a952f6f16203ef4e5a32581ae8befc5f

SHA512
e7e69d1f28091365e2fedb4a495ddbaf3df7a0fdbb1f967f7363a206d66074346b8f7b40e44d0574ae7b0a69b3ff1c83ca63cba8d2e49d237aad86f7f93dbb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\wow\mata2.bat
Filesize
250B

MD5
403b4c6c028ccba9eb8a510075e4961f

SHA1
136facdcd1fafcfe19b3d7d10ea519804b74b5b7

SHA256
9f883e7efb85d48427f0af6ea2a861a8b9f9c99d370042a387283351e545ad00

SHA512
c86f1051ff59dfbc2bf55f12ea308370d51c5e1dcda3300bbef2ee21d46d385ad220c4a2b9b60a8341e86197eb6edc1932901f6d043ac8a90b92267b81b66493

Download Submit
C:\Users\Admin\AppData\Local\Temp\wow\notepad.bat
Filesize
204B

MD5
5d72b0ef5e1a4f0682bf43754c45d114

SHA1
73a9de0a846ec9e80e5a151f1db847b90d968276

SHA256
659c5529a6acd2e53efcfc9c7ffc39c6cd00c715176ae0b6dc15802b3dbabdb0

SHA512
c73f122f0302b711239ac3778f8ba11a28bf3b9b0fc2b1a0e13bd2b9b9e9df9851275ff1aae1cb15edf58d6263a5ce52e0da3f2d452fc4486b36c7c8e2b8c779

Download Submit
memory/428-132-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/428-150-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/428-133-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/2272-134-0x0000000000000000-mapping.dmp

Download
memory/2616-146-0x0000000000000000-mapping.dmp

Download
memory/3620-144-0x0000000000000000-mapping.dmp

Download
memory/3636-135-0x0000000000000000-mapping.dmp

Download
memory/3636-142-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/3636-138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3636-151-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/3640-137-0x0000000000000000-mapping.dmp

Download
memory/4360-145-0x0000000000000000-mapping.dmp

Download
memory/4960-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads