nanocore | ced55c9b4b3dba810dc674575818bb4d9dc828d3df6efee4a15d85ac24abd69b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba261422179a87eba07096b511144796.exe
Size 1015KB
Sample230103-t3pefsca67
SHA256 ced55c9b4b3dba810dc674575818bb4d9dc828d3df6efee4a15d85ac24abd69b
MD5 ba261422179a87eba07096b511144796
SHA1 e43d13298a290398b4850e8454024b44a24aec58
SHA512 6682d6dae9235bc0ad5493d336322aebc068a87a35ba6ea243f707bc659a81ceb05a0ba383357bf60bd399e26392f2502605633121de8bf859a7412becf1136e
SSDEEP 24576:lTbBv5rU7LfY0mv8Kp71QxRMa2LSmnbrDI:PBIfYYu71QN29rDI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

december2nd.ddns.net:60451
december2n.duckdns.org:60451

Mutex

32bc7bcd-77ae-4498-9ed1-e80b3c6757f6

Attributes

activate_away_mode
false
backup_connection_host
december2n.duckdns.org
backup_dns_server
buffer_size
65538
build_time
2022-09-13T08:22:39.938021036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
60451
default_group
dec2nd
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
32bc7bcd-77ae-4498-9ed1-e80b3c6757f6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
december2nd.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
3008	ixomndv.exe
3880	RegSvcs.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	ba261422179a87eba07096b511144796.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ixomndv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_109\\ixomndv.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\1_109\\hwpkddln.dll"	ixomndv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1_109\\Update.vbs"	ixomndv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 3880	3008	ixomndv.exe	84

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
212	schtasks.exe
2532	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3880	RegSvcs.exe
3880	RegSvcs.exe
3880	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3880	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2368	4564	ba261422179a87eba07096b511144796.exe	82
PID 4564 wrote to memory of 2368	4564	ba261422179a87eba07096b511144796.exe	82
PID 4564 wrote to memory of 2368	4564	ba261422179a87eba07096b511144796.exe	82
PID 2368 wrote to memory of 3008	2368	wscript.exe	83
PID 2368 wrote to memory of 3008	2368	wscript.exe	83
PID 2368 wrote to memory of 3008	2368	wscript.exe	83
PID 3008 wrote to memory of 3880	3008	ixomndv.exe	84
PID 3008 wrote to memory of 3880	3008	ixomndv.exe	84
PID 3008 wrote to memory of 3880	3008	ixomndv.exe	84
PID 3008 wrote to memory of 3880	3008	ixomndv.exe	84
PID 3008 wrote to memory of 3880	3008	ixomndv.exe	84
PID 3880 wrote to memory of 212	3880	RegSvcs.exe	85
PID 3880 wrote to memory of 212	3880	RegSvcs.exe	85
PID 3880 wrote to memory of 212	3880	RegSvcs.exe	85
PID 3880 wrote to memory of 2532	3880	RegSvcs.exe	87
PID 3880 wrote to memory of 2532	3880	RegSvcs.exe	87
PID 3880 wrote to memory of 2532	3880	RegSvcs.exe	87

C:\Users\Admin\AppData\Local\Temp\ba261422179a87eba07096b511144796.exe
"C:\Users\Admin\AppData\Local\Temp\ba261422179a87eba07096b511144796.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" ifnsdlvxbj-xbvxpugwxr.jpg.vbe
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
    "C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe" hwpkddln.dll
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB645.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:212
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB6C3.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxbxtb.xml

Path C:\Users\Admin\AppData\Local\Temp\1_109\cxbxtb.xml
Size 36KB
SHA256 a6ce1086830a7d3f760d9ec452d0a1346693c6e1da5819534cda0fa9663fdbc7
MD5 feca51600d2ec6d2954a9514b7a6c9e4
SHA1 3854a06a0415599551f811f3590b6d567acee7ae
SHA512 d378653940b203aa3460b18e87700ebe1fa5179e86d26c9e2b32ad50017443659067fdbdb672b5af6fd16d26cd7ffc8a72c44dba1e3ea66729601a87c8156fc2
SSDEEP 768:s/PkjundZvJV8OQ93MBlZi+IMgjlrs6IdBnG5sH5at:0k6dvV8OQ93M0KulLknNHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

hwpkddln.dll

Path C:\Users\Admin\AppData\Local\Temp\1_109\hwpkddln.dll
Size 84.1MB
SHA256 a41cf06caf5ef457edb3e5506ef68912a57f8c7eb52b3d27d49240ebfb088ed7
MD5 163d27261d1bae5a8a7df43ea22da019
SHA1 10479b16304b157bad039b0ec9b1b1679bb52ace
SHA512 db818912afbce262a8b9ef85a0061869949d199eb1cf67f4f703989b746bd1480e42ff5174ddccc86a4240cd21d92583632cd643166f8fe157b884d67b5b60f0
SSDEEP 12288:YHFFraTmHFFraT6HFFraT9HFFraT/HFFraT/HFFraTVHFFraTOHFFraTWHFFraTB:sS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixomndv.exe

Path C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
Size 916KB
SHA256 b5ff7d7c58240687afd999e5b3ae09cd2d5b54834ee2d599b30a266775b6cd1b
MD5 2b448fecaa11d0fc0f48fc71f78d4b2d
SHA1 f1e4c1da88c7e7075d44dc7949a5e034cf76f002
SHA512 a86e3ce5cca820865a683238c3ca009ed1bcd93f30daa965f820b37e630d14549ffb751b51f55211d1f5b9651dd5f82b2d9032a98a644a9e0362782ae06f8e8a
SSDEEP 24576:cYgAon+KfqNbXD2XJ2PH1ddATgs/u2karPOy9:c37+KSbq5e1diEnHaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixomndv.exe

Path C:\Users\Admin\AppData\Local\Temp\1_109\ixomndv.exe
Size 916KB
SHA256 b5ff7d7c58240687afd999e5b3ae09cd2d5b54834ee2d599b30a266775b6cd1b
MD5 2b448fecaa11d0fc0f48fc71f78d4b2d
SHA1 f1e4c1da88c7e7075d44dc7949a5e034cf76f002
SHA512 a86e3ce5cca820865a683238c3ca009ed1bcd93f30daa965f820b37e630d14549ffb751b51f55211d1f5b9651dd5f82b2d9032a98a644a9e0362782ae06f8e8a
SSDEEP 24576:cYgAon+KfqNbXD2XJ2PH1ddATgs/u2karPOy9:c37+KSbq5e1diEnHaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqvleh.mxx

Path C:\Users\Admin\AppData\Local\Temp\1_109\oqvleh.mxx
Size 397KB
SHA256 5c07b03ad21c5eabb0f03dea03cb7e4b2b58ae9d591d3ce2e266f66f41608dd2
MD5 5fb9aaffca09012bc24ef31918b86053
SHA1 6f5e7bafdac7621460997ee5d81609dd2fcaaf51
SHA512 28017b8bf7a4135b54c6edcee0a62d4154cfccc47d84e07ae0d2fb806c3c1d885d7029f23d27b26931cb6c09ae67b157a2aa7f57da2839407e71067632309897
SSDEEP 3072:/5GA8gDqUGMl95jTDOWmA72KRvgr00mvlIRHqsEZitk7O65J48al5plklct4wyNm:x5VGMBJRvgr09nZim7OIy8az0a4Duf
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpB645.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB645.tmp
Size 1KB
SHA256 8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
MD5 95aceabc58acad5d73372b0966ee1b35
SHA1 2293b7ad4793cf574b1a5220e85f329b5601040a
SHA512 00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
MD5 SHA1 SHA512

Submit Download

tmpB6C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB6C3.tmp
Size 1KB
SHA256 062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
MD5 4b7ef560289c0f62d0baf6f14f48a57a
SHA1 8331acb90dde588aa3196919f6e847f398fd06d1
SHA512 ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8
MD5 SHA1 SHA512

Submit Download

ifnsdlvxbj-xbvxpugwxr.jpg.vbe

Path C:\Users\Admin\AppData\Local\temp\1_109\ifnsdlvxbj-xbvxpugwxr.jpg.vbe
Size 56KB
SHA256 8d5c665b2056e86c233aee0013ff62da4923dfdd2dfe2bc620d009b6f4cf2b18
MD5 cdcc51911ac51655ac0bfc556cf199e5
SHA1 2c13e4dddab41c73550ee07bcd45210340ca5843
SHA512 62e384dca579ef76aa76e1e06a76f5c46ee06163505c4d27080b6e790c250908692f7d0dadea1ac5d977a6e8b4ef881d3deefb65e5cfff36d26a4c4b70b602f8
SSDEEP 1536:h0QRjA0QRjT0QRjT0QRjT0QRjS0QRjR0QRjr0QRji0QRj/0QRja:hfcf3f3f3fmfNfvfWf7fu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3880-144-0x0000000000580000-0x00000000005BA000-memory.dmp

Download

memory/3880-147-0x0000000005150000-0x00000000051EC000-memory.dmp

Download

memory/3880-148-0x0000000005040000-0x000000000504A000-memory.dmp

Download

memory/3880-146-0x00000000050B0000-0x0000000005142000-memory.dmp

Download

memory/3880-145-0x00000000055C0000-0x0000000005B64000-memory.dmp

Download

memory/3880-141-0x0000000000580000-0x0000000000A5D000-memory.dmp

Download