nanocore | 25d056bc969802e62370d8876bab34af292714b1af384ad8a086ea7ee8bdee20

General

Target

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
Size

865KB
MD5

514dea47c28d5bb88c02cff9c4dde30c
SHA1

a4cdfcfaecd2f89dbb2a04b5844f555af633b03f
SHA256

25d056bc969802e62370d8876bab34af292714b1af384ad8a086ea7ee8bdee20
SHA512

0a45ea152f4093ff1ec2ccbaed6c300cef7469f05453b444a6b4fe8aee5dc10ec66fc39969da4d0f6a6dd327b031b43d2e789307b09da1ff1b54846e0a94f455
SSDEEP

12288:XcfwfbvffbkyII1A0zPooNPvmSdlGsoVKjXHXoG2jmaJgKZ/nXt7virmWhlGLaQ5:MkbvfTXAEwo1jdIso8rHYV

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

timduckdns0123.duckdns.org:52095

Mutex

0798999c-f8f7-4397-b4ae-976fe7ab5ae5

Attributes

activate_away_mode
true
backup_connection_host
timduckdns0123.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65538
build_time
2022-08-22T22:32:59.413915036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
52095
default_group
111122NOSTARTNANO
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
0798999c-f8f7-4397-b4ae-976fe7ab5ae5
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
timduckdns0123.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

description	pid	process	target process
PID 2056 set thread context of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4228 schtasks.exe
3612 schtasks.exe

pid	process
4228	schtasks.exe
3612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exepowershell.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

pid	process
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
4516	powershell.exe
2480	powershell.exe
2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2480	powershell.exe
4516	powershell.exe
2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

pid process

2456 SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

pid	process
2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exepowershell.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

description	pid	process
Token: SeDebugPrivilege	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exeSecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe

description	pid	process	target process
PID 2056 wrote to memory of 2480	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	powershell.exe
PID 2056 wrote to memory of 2480	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	powershell.exe
PID 2056 wrote to memory of 2480	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	powershell.exe
PID 2056 wrote to memory of 4516	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	powershell.exe
PID 2056 wrote to memory of 4516	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	powershell.exe
PID 2056 wrote to memory of 4516	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	powershell.exe
PID 2056 wrote to memory of 4228	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	schtasks.exe
PID 2056 wrote to memory of 4228	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	schtasks.exe
PID 2056 wrote to memory of 4228	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	schtasks.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2056 wrote to memory of 2456	2056	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
PID 2456 wrote to memory of 3612	2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	schtasks.exe
PID 2456 wrote to memory of 3612	2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	schtasks.exe
PID 2456 wrote to memory of 3612	2456	SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IiHDciRGiYI.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IiHDciRGiYI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA921.tmp"
2⤵
- Creates scheduled task(s)
PID:4228

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAE8F.tmp"
3⤵
- Creates scheduled task(s)
PID:3612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.2533.19730.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
aa014a369013774152cd337a2949a28a

SHA1
d69d9bea58eb8afa47e2154f62d5afa941da86f8

SHA256
6034f686ec7fba68baf9858e645e148c8feb6f100af9c29429b8b42d78004c87

SHA512
751edfce71003b1cf48a7ae5994d91de27c2e091a1b49df09ff922b5d88e7102e0e8d2101a6cb8eede263e0b619d93308047c451f5cbefe6e192afad16fff59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA921.tmp
Filesize
1KB

MD5
bfad05be95625f118a1ee2816625746c

SHA1
193526ad0a5f32f951959c4558a9cce31591ab6d

SHA256
116048fe04a9ef0388ad0cc58fe02be07496d01b8c1791e00131011fa8c0d593

SHA512
0640f58e00f5b0d5d07c662e9510ef6a15e5e975cff8c5fc35439b5ccd226b9a3e7c4695b5d09802cb27bc4345d2f57c217f48e26f40955bf258392733a778e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAE8F.tmp
Filesize
1KB

MD5
0a452783285ecab94076ea19a962c13e

SHA1
4da5d9698c4e028eddb9a9af8c7b5c74aad2d190

SHA256
8d8048ebd07e398d9838a029ee8458b964445a05e9a8fecd741ecac3215e694c

SHA512
c1455f6c85c8f95fe202fb391ea1373cb86b3076f944046aa8422d036e5a10fd2c014224dfe4b9052abe94c344e92027208d2902525d13221898b0d34eeea17c

Download Submit
memory/2056-133-0x0000000005FC0000-0x0000000006564000-memory.dmp

Filesize
5.6MB

Download
memory/2056-134-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/2056-135-0x00000000058E0000-0x00000000058EA000-memory.dmp

Filesize
40KB

Download
memory/2056-136-0x00000000082F0000-0x000000000838C000-memory.dmp

Filesize
624KB

Download
memory/2056-132-0x0000000000FB0000-0x000000000108E000-memory.dmp

Filesize
888KB

Download
memory/2456-147-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2456-146-0x0000000000000000-mapping.dmp

Download
memory/2480-140-0x0000000004E10000-0x0000000004E46000-memory.dmp

Filesize
216KB

Download
memory/2480-154-0x0000000006990000-0x00000000069AE000-memory.dmp

Filesize
120KB

Download
memory/2480-145-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Filesize
408KB

Download
memory/2480-143-0x0000000005310000-0x0000000005332000-memory.dmp

Filesize
136KB

Download
memory/2480-141-0x0000000005520000-0x0000000005B48000-memory.dmp

Filesize
6.2MB

Download
memory/2480-149-0x00000000062E0000-0x00000000062FE000-memory.dmp

Filesize
120KB

Download
memory/2480-158-0x0000000005150000-0x000000000515A000-memory.dmp

Filesize
40KB

Download
memory/2480-157-0x00000000076E0000-0x00000000076FA000-memory.dmp

Filesize
104KB

Download
memory/2480-137-0x0000000000000000-mapping.dmp

Download
memory/2480-153-0x00000000759E0000-0x0000000075A2C000-memory.dmp

Filesize
304KB

Download
memory/2480-159-0x0000000007970000-0x0000000007A06000-memory.dmp

Filesize
600KB

Download
memory/2480-161-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Filesize
104KB

Download
memory/2480-156-0x0000000007D20000-0x000000000839A000-memory.dmp

Filesize
6.5MB

Download
memory/3612-150-0x0000000000000000-mapping.dmp

Download
memory/4228-139-0x0000000000000000-mapping.dmp

Download
memory/4516-155-0x00000000759E0000-0x0000000075A2C000-memory.dmp

Filesize
304KB

Download
memory/4516-160-0x00000000072C0000-0x00000000072CE000-memory.dmp

Filesize
56KB

Download
memory/4516-144-0x0000000004E60000-0x0000000004EC6000-memory.dmp

Filesize
408KB

Download
memory/4516-162-0x00000000073B0000-0x00000000073B8000-memory.dmp

Filesize
32KB

Download
memory/4516-138-0x0000000000000000-mapping.dmp

Download
memory/4516-152-0x0000000006D20000-0x0000000006D52000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads