nanocore | 685c4ec1a2f35580b43db8fdf85fe8eca38731d080f8c378db4a0051a3a0d8bd

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2023, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3daecf434de806378ca5d6f4e969fea.exe
Size 592KB
Sample230119-cfj3sacd52
SHA256 685c4ec1a2f35580b43db8fdf85fe8eca38731d080f8c378db4a0051a3a0d8bd
MD5 c3daecf434de806378ca5d6f4e969fea
SHA1 caeb08efc2a87f56e909273a3ba5c34a3fa62250
SHA512 728c6b5a36710b85e53ce35f00bb262a6076542e2dda542c41ead4fe873b7bb76220eda5f195bfc6a43e661651329bbbe89fbe9cb31f01fa26ff79885ba14042
SSDEEP 12288:SYrVpkiWYIHH4V7C2vDGVMb7PeKVyVIjEdj5ZSE7xiPvCnhz4Q5iR:SYrVpkiIHYV7L7GVMnepKjErEPvChkQY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

favgrandson7.sytes.net:2500
127.0.0.1:2500

Mutex

f84acc99-4ee4-4bae-b0e7-75cfd51b66bd

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-10-25T18:05:52.427403836Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2500
default_group
JAN132023
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f84acc99-4ee4-4bae-b0e7-75cfd51b66bd
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
favgrandson7.sytes.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
4816	iweenb.exe
944	iweenb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe"	iweenb.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iweenb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 944	4816	iweenb.exe	82

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	iweenb.exe
File opened for modification	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	iweenb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4724	schtasks.exe
1988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
944	iweenb.exe
944	iweenb.exe
944	iweenb.exe
944	iweenb.exe
944	iweenb.exe
944	iweenb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
944	iweenb.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4816	iweenb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	iweenb.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4816	4912	c3daecf434de806378ca5d6f4e969fea.exe	81
PID 4912 wrote to memory of 4816	4912	c3daecf434de806378ca5d6f4e969fea.exe	81
PID 4912 wrote to memory of 4816	4912	c3daecf434de806378ca5d6f4e969fea.exe	81
PID 4816 wrote to memory of 944	4816	iweenb.exe	82
PID 4816 wrote to memory of 944	4816	iweenb.exe	82
PID 4816 wrote to memory of 944	4816	iweenb.exe	82
PID 4816 wrote to memory of 944	4816	iweenb.exe	82
PID 944 wrote to memory of 4724	944	iweenb.exe	83
PID 944 wrote to memory of 4724	944	iweenb.exe	83
PID 944 wrote to memory of 4724	944	iweenb.exe	83
PID 944 wrote to memory of 1988	944	iweenb.exe	85
PID 944 wrote to memory of 1988	944	iweenb.exe	85
PID 944 wrote to memory of 1988	944	iweenb.exe	85

C:\Users\Admin\AppData\Local\Temp\c3daecf434de806378ca5d6f4e969fea.exe
"C:\Users\Admin\AppData\Local\Temp\c3daecf434de806378ca5d6f4e969fea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\iweenb.exe
  "C:\Users\Admin\AppData\Local\Temp\iweenb.exe" C:\Users\Admin\AppData\Local\Temp\yobzf.i
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\iweenb.exe
    "C:\Users\Admin\AppData\Local\Temp\iweenb.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC623.tmp"
      4⤵
      Creates scheduled task(s)
      PID:4724
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC6EF.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iweenb.exe

Path C:\Users\Admin\AppData\Local\Temp\iweenb.exe
Size 100KB
SHA256 65216f76fc9bf92e8f56d3da7124c2f2860bdd92d245e040e1589694bc0295b8
MD5 4feb273efdc33b09ce135b83442c3227
SHA1 1442e48d7ef4d7176c7cef3f95b759d87fcb2d33
SHA512 395725e14d6cced27bbd0248a64f69c82bd59ceb3fdcce4d63ce20c86aeaebdb1efea83b6b5f84a48362f53c4a4e597dc543777acd0de33d953c46711d50123e
SSDEEP 1536:yoJrPl54EsPLskvqzGUUzKx0sDuEse2OdHL8JiuGISrFuDthslJ5:JJBC/PLdXUUzKxbuBJi9+hsH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

iweenb.exe

Path C:\Users\Admin\AppData\Local\Temp\iweenb.exe
Size 100KB
SHA256 65216f76fc9bf92e8f56d3da7124c2f2860bdd92d245e040e1589694bc0295b8
MD5 4feb273efdc33b09ce135b83442c3227
SHA1 1442e48d7ef4d7176c7cef3f95b759d87fcb2d33
SHA512 395725e14d6cced27bbd0248a64f69c82bd59ceb3fdcce4d63ce20c86aeaebdb1efea83b6b5f84a48362f53c4a4e597dc543777acd0de33d953c46711d50123e
SSDEEP 1536:yoJrPl54EsPLskvqzGUUzKx0sDuEse2OdHL8JiuGISrFuDthslJ5:JJBC/PLdXUUzKxbuBJi9+hsH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

iweenb.exe

Path C:\Users\Admin\AppData\Local\Temp\iweenb.exe
Size 100KB
SHA256 65216f76fc9bf92e8f56d3da7124c2f2860bdd92d245e040e1589694bc0295b8
MD5 4feb273efdc33b09ce135b83442c3227
SHA1 1442e48d7ef4d7176c7cef3f95b759d87fcb2d33
SHA512 395725e14d6cced27bbd0248a64f69c82bd59ceb3fdcce4d63ce20c86aeaebdb1efea83b6b5f84a48362f53c4a4e597dc543777acd0de33d953c46711d50123e
SSDEEP 1536:yoJrPl54EsPLskvqzGUUzKx0sDuEse2OdHL8JiuGISrFuDthslJ5:JJBC/PLdXUUzKxbuBJi9+hsH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpC623.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC623.tmp
Size 1KB
SHA256 f283cc6fc522a188996a233b044fbe7efbf156d2eb97f19afc0eca7e05e6ec6e
MD5 eed4c3e186cc3f8a4e08f7aec68b6c30
SHA1 4f91b5fdfd29177e9c85cf3554f46bee18a5ea36
SHA512 8675829f9518a7dffadc838fd057c42838428afa8f1dae9e76c4ae3f57d93a503479c798bb462cb7eea75b80ad032313703a380753f151fcb1ae070f8b76f4bc
MD5 SHA1 SHA512

Submit Download

tmpC6EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC6EF.tmp
Size 1KB
SHA256 99a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
MD5 2f26d92c1eeead3896820e56ec46f6f1
SHA1 d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA512 6c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
MD5 SHA1 SHA512

Submit Download

ukaqwfl.bgf

Path C:\Users\Admin\AppData\Local\Temp\ukaqwfl.bgf
Size 301KB
SHA256 b11f9958fe2a4b59989b2e87877f7799caaf3dcf5a0de90a4ecd21b6546f32f6
MD5 119695441ff1b90e961b7da8cd51466c
SHA1 8f6435c4092d24132fccf3c8279bb44e46b85c89
SHA512 95656969edf499a81486a2a08dab66e5ca209d6fbd6db35eaa7af4230fd5dffbca948ce1efd18a169c5ee4a2812fef4808ae6a12fc3cea6e3dd604238d8d6dc8
SSDEEP 6144:IgpRiBm0yYeuiTzkekBpRbRrPgUlOYdxwv93vk0/YEUDMjw54XvIeSGrJRg9Z3L:IgpRLoeui/v0pR98Ulndx693v5/YEUDj
MD5 SHA1 SHA512 SSDEEP

Submit Download

yobzf.i

Path C:\Users\Admin\AppData\Local\Temp\yobzf.i
Size 6KB
SHA256 c0d32a5533800da6e656ec2b978a1045181b7ab7e011d96df136440fd3c9f250
MD5 bf1f3325d7462b5a541bbf3702d16ea9
SHA1 4db9df08892b79ff7965665803fe52b5fa90726e
SHA512 fd7bb1a881baf45fb876ed91651b32758ebfeecb690ce12a775250347ee2f050b69b810740cfd0d45fb2aec39c13166e6a471abb601c849131757a01e9980408
SSDEEP 192:FarcRxb+TO5hX1S9v2P1s8Jr+IrGfuwPvUX7fc+:vxK9v2SQrOmYsLc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/944-140-0x00000000049C0000-0x0000000004A52000-memory.dmp

Download

memory/944-141-0x0000000005090000-0x000000000512C000-memory.dmp

Download

memory/944-142-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/944-143-0x0000000005160000-0x000000000516A000-memory.dmp

Download

memory/944-139-0x0000000004AA0000-0x0000000005044000-memory.dmp

Download

memory/944-148-0x0000000006310000-0x0000000006376000-memory.dmp

Download