nanocore | 1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062

General

Target
1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
Size 615KB
Sample221127-aa131aed48
SHA256 1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062
MD5 0a8a66d67bf1c167885bffe3c2de2669
SHA1 3e8448cd135263dcf513e09cfcace9382dc577b1
SHA512 dcd1d0b1eeaaf789631303ad844fea65e7b5cdbe2e10a7d213a74720e84ff1651708f99724aa2e9f0b4c6a74def87847d0ed75085a295b3adc939f09724e1922
SSDEEP 12288:vOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiIkDL6tNsFqYpwU35ZI:vq5TfcdHj4fmbUDL6nY935ZI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

moftsvs.ig42.org:9045
212.7.192.242:9045

Mutex

c7bf44a3-7212-4d60-9ee3-f0991c8392f8

Attributes

activate_away_mode
false
backup_connection_host
212.7.192.242
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2015-03-06T14:55:41.478810836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
9045
default_group
Default Team
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c7bf44a3-7212-4d60-9ee3-f0991c8392f8
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
moftsvs.ig42.org
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4252-132-0x0000000000CE0000-0x0000000000E45000-memory.dmp	upx
behavioral2/memory/4252-135-0x0000000000CE0000-0x0000000000E45000-memory.dmp	upx
behavioral2/memory/4304-139-0x0000000000CE0000-0x0000000000E45000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4252-135-0x0000000000CE0000-0x0000000000E45000-memory.dmp	autoit_exe
behavioral2/memory/4304-139-0x0000000000CE0000-0x0000000000E45000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4304 set thread context of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3692	3968	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4304	4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	82
PID 4252 wrote to memory of 4304	4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	82
PID 4252 wrote to memory of 4304	4252	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	82
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84
PID 4304 wrote to memory of 3968	4304	1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe	84

C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
  "C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" "1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:3968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 12
      4⤵
      Program crash
      PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3968 -ip 3968
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ger

Path C:\Users\Admin\AppData\Local\Temp\ger
Size 202KB
SHA256 06538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
MD5 62cddffde88715a338548dbfa47b555c
SHA1 17d9eed664beee32f9fa62d61daaaac931885e51
SHA512 0fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442
SSDEEP 6144:BqAX9BlHSUG7pphWIICm3yK2wiYvZisBE8TWOi4MV9:BpXrlNapctCm3KwDIiE8TWOid
MD5 SHA1 SHA512 SSDEEP

Submit Download

lf2

Path C:\Users\Admin\AppData\Local\Temp\lf2
Size 5KB
SHA256 d399db8ae87b1d97732184cd2bbf67d745c4146cf8d6d33e26bedcfd53384064
MD5 be7a4ea468b142994adae5c442dfdd06
SHA1 606fb007510259993f4726a8d0b1f41fa1de23d9
SHA512 c55609f24408106a2e171cd7f691eeecb81b99be6023bdec672e578bf5bfc5ca787d94d9a5affff98a0c996771ba5da5d53d4b499240571b957a90c0e3059511
SSDEEP 96:hFz1hTciHId9lk+16+p3mGHMlxxVqxo7SXcF8NCBlAR6NBlSRi5OPENv2VzNh/8d:UjUVRVq3NCcmBlSR2OPE52VzfStP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3968-138-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4252-132-0x0000000000CE0000-0x0000000000E45000-memory.dmp

Download

memory/4252-135-0x0000000000CE0000-0x0000000000E45000-memory.dmp

Download

memory/4304-139-0x0000000000CE0000-0x0000000000E45000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads