nanocore | d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a

General

Target

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
Size

914KB
MD5

fa451d9fcbb382547304fb3c197df41f
SHA1

a94eab5ed10b473a368bd2b952a36e1cfb6a86f3
SHA256

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a
SHA512

4205f65b521bbd54287184c2a064f0f6b43fa500d1fb350bd81f120e7f5bca64e8201909ac105ae0d2a7196a7e1199bace5fa0533951436051deed3e44ff8ee5
SSDEEP

12288:Ha05RoPvP+hzDMm/xy/e4rJPVI80bk7DrBfJgZWw:hQPvGhHZWe4rJrMq5wW

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

judge777.ddns.net:8282

127.0.0.1:8282

Mutex

ff326974-84e5-4f7e-884c-dce6bafebcc3

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2020-11-15T21:34:27.835212036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8282
default_group
FEB
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
ff326974-84e5-4f7e-884c-dce6bafebcc3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
judge777.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 37.235.1.174
Destination IP 37.235.1.174
Destination IP 37.235.1.177
Destination IP 37.235.1.177
Destination IP 37.235.1.174

description	ioc
Destination IP	37.235.1.174
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.177
Destination IP	37.235.1.174

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Manager = "C:\\Program Files (x86)\\AGP Manager\\agpmgr.exe"	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description	pid	process	target process
PID 1228 set thread context of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

Drops file in Program Files directory 2 IoCs

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Manager\agpmgr.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
File opened for modification	C:\Program Files (x86)\AGP Manager\agpmgr.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

588 schtasks.exe

pid	process
588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

pid	process
620	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
620	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

pid process

620 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description pid process

Token: SeDebugPrivilege 620 d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description	pid	process
Token: SeDebugPrivilege	620	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

description	pid	process	target process
PID 1228 wrote to memory of 588	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	schtasks.exe
PID 1228 wrote to memory of 588	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	schtasks.exe
PID 1228 wrote to memory of 588	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	schtasks.exe
PID 1228 wrote to memory of 588	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	schtasks.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
PID 1228 wrote to memory of 620	1228	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe	d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe

C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
"C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sfnsjitbxRvkvq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3757.tmp"
2⤵
- Creates scheduled task(s)
PID:588

C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe
"C:\Users\Admin\AppData\Local\Temp\d31fdbf6220e3ab12cb51cbe502fde0cb5b485c0b187791cad1a06e0117db36a.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3757.tmp
Filesize
1KB

MD5
45164c389a71999921a12e51dd7da24e

SHA1
160af9dce95c6756c33d56503671bc068a5319d1

SHA256
98818cfd8b509ecb9c78ee912e2ba91f4669ea3464d3dce6a4dea975daa1ed85

SHA512
6fcb460011f0fa32c4712ee1ce562b1ee4771a86a0ff95e45f09072d64a86588d9ec0e5dd63105195c1e57e68d0648aedb343bdf0e28af8bab0c66d66b780a33

Download Submit
memory/588-58-0x0000000000000000-mapping.dmp

Download
memory/620-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/620-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/620-75-0x00000000008D0000-0x00000000008DA000-memory.dmp

Filesize
40KB

Download
memory/620-74-0x0000000001EA0000-0x0000000001EBE000-memory.dmp

Filesize
120KB

Download
memory/620-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/620-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/620-73-0x00000000008C0000-0x00000000008CA000-memory.dmp

Filesize
40KB

Download
memory/620-71-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/620-67-0x000000000041E792-mapping.dmp

Download
memory/620-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/620-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1228-57-0x0000000004690000-0x00000000046FA000-memory.dmp

Filesize
424KB

Download
memory/1228-54-0x0000000000970000-0x0000000000A5A000-memory.dmp

Filesize
936KB

Download
memory/1228-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1228-56-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads