nanocore | 5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90

Analysis

max time kernel
148s
max time network
174s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
Size

1.7MB
MD5

30bfef26fc5534fa14f9b49dce1326e1
SHA1

77cacad9da906efcd52f04baaf915ffc7f752bf4
SHA256

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90
SHA512

025e1576ae92c1873d3747b260ef8344201beceb621f661a0af98012f97df2edc1768ea188e209704be92b09f8c031a3ef9380e5850958d0b7808e3f9d9bffeb
SSDEEP

12288:0JFsMWlD6Vw8oL11cbGWwFlbKfKQ+8cG1MHf8Y99LZQW2:0TsMUDlp11zgOF63Y99lQW

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

cheapshoes.ddns.net:5777

Mutex

14402f30-27a2-4a1f-8535-360e73bcc909

Attributes

activate_away_mode
true
backup_connection_host
cheapshoes.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2014-12-09T03:06:33.524119536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5777
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
14402f30-27a2-4a1f-8535-360e73bcc909
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
cheapshoes.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\winlogon.exe"	reg.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

1816 svhost.exe
Loads dropped DLL 3 IoCs

Processes:

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exesvhost.exe

pid process

1460 5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
1816 svhost.exe
1816 svhost.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

svhost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe

pid	process
1816	svhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe

description	pid	process	target process
PID 1460 set thread context of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

428 timeout.exe

pid	process
428	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exesvhost.exe

pid	process
1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
1816	svhost.exe
1816	svhost.exe
1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svhost.exe

pid process

1816 svhost.exe

pid	process
1816	svhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exesvhost.exe

description	pid	process
Token: SeDebugPrivilege	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
Token: 33	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
Token: SeIncBasePriorityPrivilege	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
Token: SeDebugPrivilege	1816	svhost.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.execmd.exewscript.execmd.execmd.exe

description	pid	process	target process
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 892	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 892 wrote to memory of 272	892	cmd.exe	wscript.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 1460 wrote to memory of 1816	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	svhost.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 272 wrote to memory of 1308	272	wscript.exe	cmd.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1308 wrote to memory of 1520	1308	cmd.exe	reg.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 1460 wrote to memory of 292	1460	5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe	cmd.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe
PID 292 wrote to memory of 428	292	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe
"C:\Users\Admin\AppData\Local\Temp\5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Roaming\FolderName\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs" "C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderName\winlogon.exe" /f
5⤵
- Modifies WinLogon for persistence
PID:1520

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\FolderName\svhost.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\SysWOW64\timeout.exe
timeout /t 300
3⤵
- Delays execution with timeout.exe
PID:428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs
Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata.bat
Filesize
76B

MD5
5e57f6f4e3242ad9719ed5e65346e83e

SHA1
72346d0208c5edeb69f41ddb4374d56d87221dad

SHA256
4ffb3e764dfbc48145231f19e2217f666bc88a44c6f29adec6a5728223048d0c

SHA512
7dcd8a5a95965b94bf26ec02ab68b8f854f399d41fb713e4387f6fddb9914c465ccf909f92ee6704e9c0397a77f11f2ca803d68184aa414651988d95824a209f

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat
Filesize
278B

MD5
590e84b911b339d533542f396b3dbc3d

SHA1
ba8f46501107d5fb98da863af9c6b6815d421e8a

SHA256
b494430c12ee3d46dcb837428dd414679d3b586b4365ea2dbf9924c2bfb099aa

SHA512
ae1f1bdc950dab9e87455330cdf6b1f2916a433db7642963803a13b3ef1f82d883b837bf6a782745be0852aedcce3bad1188e0557109fa11a17970c68975c118

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\svhost.bat
Filesize
210B

MD5
7b0fa82cf98c912de85a803f25000802

SHA1
a989161d4059f4a3aa9561a732d8511a76d92f93

SHA256
3280e716885f9173246f3cc66ac890964faa3a2a9f9c738de978eb46005f78b0

SHA512
d37b0654ca05d7a8d0712a9867c4885a6690819a7040491f05ec755995b33188f8e3e6bb384d2469af8f5073ed2ee05aa4bea2c40cd1607ee612671a0c7bbe5a

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\winlogon.exe
Filesize
1.7MB

MD5
30bfef26fc5534fa14f9b49dce1326e1

SHA1
77cacad9da906efcd52f04baaf915ffc7f752bf4

SHA256
5aaa85cd2b644c641ebd2e5f42d11229f46314a4cfea47268d9565ff99c72f90

SHA512
025e1576ae92c1873d3747b260ef8344201beceb621f661a0af98012f97df2edc1768ea188e209704be92b09f8c031a3ef9380e5850958d0b7808e3f9d9bffeb

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
memory/272-59-0x0000000000000000-mapping.dmp

Download
memory/292-88-0x0000000000000000-mapping.dmp

Download
memory/428-92-0x0000000000000000-mapping.dmp

Download
memory/892-56-0x0000000000000000-mapping.dmp

Download
memory/1308-81-0x0000000000000000-mapping.dmp

Download
memory/1460-86-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1460-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1460-94-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1460-55-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1520-84-0x0000000000000000-mapping.dmp

Download
memory/1816-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1816-83-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1816-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1816-70-0x000000000041E792-mapping.dmp

Download
memory/1816-87-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1816-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1816-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1816-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1816-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1816-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download