nanocore | ced55c9b4b3dba810dc674575818bb4d9dc828d3df6efee4a15d85ac24abd69b

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/01/2023, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba261422179a87eba07096b511144796.exe
Size 1015KB
Sample230103-t3pefsca67
SHA256 ced55c9b4b3dba810dc674575818bb4d9dc828d3df6efee4a15d85ac24abd69b
MD5 ba261422179a87eba07096b511144796
SHA1 e43d13298a290398b4850e8454024b44a24aec58
SHA512 6682d6dae9235bc0ad5493d336322aebc068a87a35ba6ea243f707bc659a81ceb05a0ba383357bf60bd399e26392f2502605633121de8bf859a7412becf1136e
SSDEEP 24576:lTbBv5rU7LfY0mv8Kp71QxRMa2LSmnbrDI:PBIfYYu71QN29rDI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

december2nd.ddns.net:60451
december2n.duckdns.org:60451

Mutex

32bc7bcd-77ae-4498-9ed1-e80b3c6757f6

Attributes

activate_away_mode
false
backup_connection_host
december2n.duckdns.org
backup_dns_server
buffer_size
65538
build_time
2022-09-13T08:22:39.938021036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
60451
default_group
dec2nd
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
32bc7bcd-77ae-4498-9ed1-e80b3c6757f6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
december2nd.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
988	ixomndv.exe
2032	RegSvcs.exe

Loads dropped DLL 2 IoCs

pid	Process
1364	wscript.exe
988	ixomndv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ixomndv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_109\\ixomndv.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\1_109\\hwpkddln.dll"	ixomndv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_109\\Update.vbs"	ixomndv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 2032	988	ixomndv.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2004	schtasks.exe
1880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	RegSvcs.exe
2032	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	RegSvcs.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1364	1944	ba261422179a87eba07096b511144796.exe	27
PID 1944 wrote to memory of 1364	1944	ba261422179a87eba07096b511144796.exe	27
PID 1944 wrote to memory of 1364	1944	ba261422179a87eba07096b511144796.exe	27
PID 1944 wrote to memory of 1364	1944	ba261422179a87eba07096b511144796.exe	27
PID 1364 wrote to memory of 988	1364	wscript.exe	28
PID 1364 wrote to memory of 988	1364	wscript.exe	28
PID 1364 wrote to memory of 988	1364	wscript.exe	28
PID 1364 wrote to memory of 988	1364	wscript.exe	28
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 988 wrote to memory of 2032	988	ixomndv.exe	29
PID 2032 wrote to memory of 2004	2032	RegSvcs.exe	30
PID 2032 wrote to memory of 2004	2032	RegSvcs.exe	30
PID 2032 wrote to memory of 2004	2032	RegSvcs.exe	30
PID 2032 wrote to memory of 2004	2032	RegSvcs.exe	30
PID 2032 wrote to memory of 1880	2032	RegSvcs.exe	32
PID 2032 wrote to memory of 1880	2032	RegSvcs.exe	32
PID 2032 wrote to memory of 1880	2032	RegSvcs.exe	32
PID 2032 wrote to memory of 1880	2032	RegSvcs.exe	32

C:\Users\Admin\AppData\Local\Temp\ba261422179a87eba07096b511144796.exe
"C:\Users\Admin\AppData\Local\Temp\ba261422179a87eba07096b511144796.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" ifnsdlvxbj-xbvxpugwxr.jpg.vbe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
    "C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe" hwpkddln.dll
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp406B.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2004
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp429E.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxbxtb.xml

Path C:\Users\Admin\AppData\Local\Temp\1_109\cxbxtb.xml
Size 36KB
SHA256 a6ce1086830a7d3f760d9ec452d0a1346693c6e1da5819534cda0fa9663fdbc7
MD5 feca51600d2ec6d2954a9514b7a6c9e4
SHA1 3854a06a0415599551f811f3590b6d567acee7ae
SHA512 d378653940b203aa3460b18e87700ebe1fa5179e86d26c9e2b32ad50017443659067fdbdb672b5af6fd16d26cd7ffc8a72c44dba1e3ea66729601a87c8156fc2
SSDEEP 768:s/PkjundZvJV8OQ93MBlZi+IMgjlrs6IdBnG5sH5at:0k6dvV8OQ93M0KulLknNHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

hwpkddln.dll

Path C:\Users\Admin\AppData\Local\Temp\1_109\hwpkddln.dll
Size 84.1MB
SHA256 a41cf06caf5ef457edb3e5506ef68912a57f8c7eb52b3d27d49240ebfb088ed7
MD5 163d27261d1bae5a8a7df43ea22da019
SHA1 10479b16304b157bad039b0ec9b1b1679bb52ace
SHA512 db818912afbce262a8b9ef85a0061869949d199eb1cf67f4f703989b746bd1480e42ff5174ddccc86a4240cd21d92583632cd643166f8fe157b884d67b5b60f0
SSDEEP 12288:YHFFraTmHFFraT6HFFraT9HFFraT/HFFraT/HFFraTVHFFraTOHFFraTWHFFraTB:sS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixomndv.exe

Path C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
Size 916KB
SHA256 b5ff7d7c58240687afd999e5b3ae09cd2d5b54834ee2d599b30a266775b6cd1b
MD5 2b448fecaa11d0fc0f48fc71f78d4b2d
SHA1 f1e4c1da88c7e7075d44dc7949a5e034cf76f002
SHA512 a86e3ce5cca820865a683238c3ca009ed1bcd93f30daa965f820b37e630d14549ffb751b51f55211d1f5b9651dd5f82b2d9032a98a644a9e0362782ae06f8e8a
SSDEEP 24576:cYgAon+KfqNbXD2XJ2PH1ddATgs/u2karPOy9:c37+KSbq5e1diEnHaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixomndv.exe

Path C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
Size 916KB
SHA256 b5ff7d7c58240687afd999e5b3ae09cd2d5b54834ee2d599b30a266775b6cd1b
MD5 2b448fecaa11d0fc0f48fc71f78d4b2d
SHA1 f1e4c1da88c7e7075d44dc7949a5e034cf76f002
SHA512 a86e3ce5cca820865a683238c3ca009ed1bcd93f30daa965f820b37e630d14549ffb751b51f55211d1f5b9651dd5f82b2d9032a98a644a9e0362782ae06f8e8a
SSDEEP 24576:cYgAon+KfqNbXD2XJ2PH1ddATgs/u2karPOy9:c37+KSbq5e1diEnHaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqvleh.mxx

Path C:\Users\Admin\AppData\Local\Temp\1_109\oqvleh.mxx
Size 397KB
SHA256 5c07b03ad21c5eabb0f03dea03cb7e4b2b58ae9d591d3ce2e266f66f41608dd2
MD5 5fb9aaffca09012bc24ef31918b86053
SHA1 6f5e7bafdac7621460997ee5d81609dd2fcaaf51
SHA512 28017b8bf7a4135b54c6edcee0a62d4154cfccc47d84e07ae0d2fb806c3c1d885d7029f23d27b26931cb6c09ae67b157a2aa7f57da2839407e71067632309897
SSDEEP 3072:/5GA8gDqUGMl95jTDOWmA72KRvgr00mvlIRHqsEZitk7O65J48al5plklct4wyNm:x5VGMBJRvgr09nZim7OIy8az0a4Duf
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp406B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp406B.tmp
Size 1KB
SHA256 8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
MD5 95aceabc58acad5d73372b0966ee1b35
SHA1 2293b7ad4793cf574b1a5220e85f329b5601040a
SHA512 00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
MD5 SHA1 SHA512

Submit Download

tmp429E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp429E.tmp
Size 1KB
SHA256 11ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527
MD5 981e126601526eaa5b0ad45c496c4465
SHA1 d610d6a21a8420cc73fcd3e54ddae75a5897b28b
SHA512 a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb
MD5 SHA1 SHA512

Submit Download

ifnsdlvxbj-xbvxpugwxr.jpg.vbe

Path C:\Users\Admin\AppData\Local\temp\1_109\ifnsdlvxbj-xbvxpugwxr.jpg.vbe
Size 56KB
SHA256 8d5c665b2056e86c233aee0013ff62da4923dfdd2dfe2bc620d009b6f4cf2b18
MD5 cdcc51911ac51655ac0bfc556cf199e5
SHA1 2c13e4dddab41c73550ee07bcd45210340ca5843
SHA512 62e384dca579ef76aa76e1e06a76f5c46ee06163505c4d27080b6e790c250908692f7d0dadea1ac5d977a6e8b4ef881d3deefb65e5cfff36d26a4c4b70b602f8
SSDEEP 1536:h0QRjA0QRjT0QRjT0QRjT0QRjS0QRjR0QRjr0QRji0QRj/0QRja:hfcf3f3f3fmfNfvfWf7fu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixomndv.exe

Path \Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
Size 916KB
SHA256 b5ff7d7c58240687afd999e5b3ae09cd2d5b54834ee2d599b30a266775b6cd1b
MD5 2b448fecaa11d0fc0f48fc71f78d4b2d
SHA1 f1e4c1da88c7e7075d44dc7949a5e034cf76f002
SHA512 a86e3ce5cca820865a683238c3ca009ed1bcd93f30daa965f820b37e630d14549ffb751b51f55211d1f5b9651dd5f82b2d9032a98a644a9e0362782ae06f8e8a
SSDEEP 24576:cYgAon+KfqNbXD2XJ2PH1ddATgs/u2karPOy9:c37+KSbq5e1diEnHaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path \Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Download

memory/2032-69-0x00000000004F0000-0x0000000000BC0000-memory.dmp

Download

memory/2032-77-0x00000000004F0000-0x000000000052A000-memory.dmp

Download

memory/2032-75-0x00000000004F0000-0x0000000000BC0000-memory.dmp

Download

memory/2032-73-0x00000000004F0000-0x0000000000BC0000-memory.dmp

Download

memory/2032-67-0x00000000004F0000-0x0000000000BC0000-memory.dmp

Download

memory/2032-83-0x0000000000390000-0x000000000039A000-memory.dmp

Download

memory/2032-84-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Download

memory/2032-85-0x0000000000C20000-0x0000000000C3E000-memory.dmp

Download

memory/2032-86-0x00000000010F0000-0x00000000010FA000-memory.dmp

Download