nanocore | 8eb139b9852b5f4259aff1b4bc39b07184f8fe088d7277ac0e3c8800fe0bc261

General

Target

DHL_Receipts_scanned^^^.scr.exe
Size

333KB
MD5

e5fcecd110753e63072de73e9b4ac671
SHA1

3de5eece281193ea60de8fdaf6001f9d7c973a91
SHA256

8eb139b9852b5f4259aff1b4bc39b07184f8fe088d7277ac0e3c8800fe0bc261
SHA512

0ecf6fe4467077b247c6a4dc870cd29c806222779fd79a1b1303fbb86225465144d2f6cc949e74fdcaef243a19e04408ad74ae1e650e218f663895954d048ef2
SSDEEP

6144:NBn0unJ8KzJGd/rkXPw+iW7LeZd0BG8Ct+MRCO73aLbV4rqXmpJLKDRGG1e7:Eu2KksPdi370BG8CtlD3aN42GL0GG1M

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

neoncorex.duckdns.org:2022

Mutex

39dcee1b-ef73-4d3f-85a3-0a94551eac95

Attributes

activate_away_mode
true
backup_connection_host
neoncorex.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-11-21T01:20:38.920982636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
2022
default_group
2022LOGS
enable_debug_mode
true
gc_threshold
1.0485798e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
39dcee1b-ef73-4d3f-85a3-0a94551eac95
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
neoncorex.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

bwbhwwvvw.exebwbhwwvvw.exe

pid process

3660 bwbhwwvvw.exe
3656 bwbhwwvvw.exe

pid	process
3660	bwbhwwvvw.exe
3656	bwbhwwvvw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bwbhwwvvw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ksctecmgh = "C:\\Users\\Admin\\AppData\\Roaming\\imadsuuwig\\blhpmbfyr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\bwbhwwvvw.exe\" C:\\Users\\Admin\\AppData\\L"	bwbhwwvvw.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bwbhwwvvw.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bwbhwwvvw.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

bwbhwwvvw.exe

description pid process target process

PID 3660 set thread context of 3656 3660 bwbhwwvvw.exe bwbhwwvvw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bwbhwwvvw.exe

pid process

3656 bwbhwwvvw.exe
3656 bwbhwwvvw.exe
3656 bwbhwwvvw.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bwbhwwvvw.exe

pid process

3656 bwbhwwvvw.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bwbhwwvvw.exe

pid process

3660 bwbhwwvvw.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bwbhwwvvw.exe

description pid process

Token: SeDebugPrivilege 3656 bwbhwwvvw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bwbhwwvvw.exe

description	pid	process	target process
PID 3660 set thread context of 3656	3660	bwbhwwvvw.exe	bwbhwwvvw.exe

pid	process
3656	bwbhwwvvw.exe
3656	bwbhwwvvw.exe
3656	bwbhwwvvw.exe

pid	process
3656	bwbhwwvvw.exe

pid	process
3660	bwbhwwvvw.exe

description	pid	process
Token: SeDebugPrivilege	3656	bwbhwwvvw.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

DHL_Receipts_scanned^^^.scr.exebwbhwwvvw.exe

description	pid	process	target process
PID 2024 wrote to memory of 3660	2024	DHL_Receipts_scanned^^^.scr.exe	bwbhwwvvw.exe
PID 2024 wrote to memory of 3660	2024	DHL_Receipts_scanned^^^.scr.exe	bwbhwwvvw.exe
PID 2024 wrote to memory of 3660	2024	DHL_Receipts_scanned^^^.scr.exe	bwbhwwvvw.exe
PID 3660 wrote to memory of 3656	3660	bwbhwwvvw.exe	bwbhwwvvw.exe
PID 3660 wrote to memory of 3656	3660	bwbhwwvvw.exe	bwbhwwvvw.exe
PID 3660 wrote to memory of 3656	3660	bwbhwwvvw.exe	bwbhwwvvw.exe
PID 3660 wrote to memory of 3656	3660	bwbhwwvvw.exe	bwbhwwvvw.exe

C:\Users\Admin\AppData\Local\Temp\DHL_Receipts_scanned^^^.scr.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Receipts_scanned^^^.scr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe
"C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe" C:\Users\Admin\AppData\Local\Temp\yjijqvmhf.bsq
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3660

C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe
"C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe
Filesize
13KB

MD5
ce95f5952f0dc3740c324330a1f338da

SHA1
e72400e1b7d4b7893bd65629fbe9fb6ac77e0135

SHA256
a65938aca4f1aec627735e6650d0cb6ca78ed3439715a8a165ac07d0afc4dccc

SHA512
b7afa3de57ec7d034432206fd6d8ca9a8023d72f34104422463f5192865a7e79463721d5c726d6807b1a16f52dfc65499850a33f8abb4ae0ac6c61936b5fd0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe
Filesize
13KB

MD5
ce95f5952f0dc3740c324330a1f338da

SHA1
e72400e1b7d4b7893bd65629fbe9fb6ac77e0135

SHA256
a65938aca4f1aec627735e6650d0cb6ca78ed3439715a8a165ac07d0afc4dccc

SHA512
b7afa3de57ec7d034432206fd6d8ca9a8023d72f34104422463f5192865a7e79463721d5c726d6807b1a16f52dfc65499850a33f8abb4ae0ac6c61936b5fd0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\bwbhwwvvw.exe
Filesize
13KB

MD5
ce95f5952f0dc3740c324330a1f338da

SHA1
e72400e1b7d4b7893bd65629fbe9fb6ac77e0135

SHA256
a65938aca4f1aec627735e6650d0cb6ca78ed3439715a8a165ac07d0afc4dccc

SHA512
b7afa3de57ec7d034432206fd6d8ca9a8023d72f34104422463f5192865a7e79463721d5c726d6807b1a16f52dfc65499850a33f8abb4ae0ac6c61936b5fd0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\hnslvwz.qg
Filesize
280KB

MD5
1fcb86f0d8bcffb397724cd1ce51506c

SHA1
794662229d284cc149a02847a8bfe987603d2675

SHA256
1323328ea053d7be6056ffbd84baf7414cb78fe1dc77cb22f008a73ab66178a1

SHA512
90fc2807949127ddaacc2029f983fe8152ea3ab4437dc242585013a4b9a60c5d355733332337100dd3cf8891b1320bc71cb76c5e24294571ac1b23c91d012d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\yjijqvmhf.bsq
Filesize
7KB

MD5
3f1f6fa65fd566b70196094b05b4bf2c

SHA1
a78220174ee66983de6ee80722fae46a75c0d959

SHA256
558340501757c00d168f244cc18feee60bb6c6e82cd41c0aaeb42826578a75bb

SHA512
75248b2d81c8b855b322207debb182e35b2e07c75948c08f970eedf5b79df0655c21695be7de9bedc14794224955a8a2a8f7881044696e96699e95757f5b3aaf

Download Submit
memory/3656-137-0x0000000000000000-mapping.dmp

Download
memory/3656-139-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3656-140-0x00000000051F0000-0x0000000005794000-memory.dmp

Filesize
5.6MB

Download
memory/3656-141-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Filesize
584KB

Download
memory/3656-142-0x0000000004D80000-0x0000000004E1C000-memory.dmp

Filesize
624KB

Download
memory/3656-143-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/3660-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing