nanocore | 76e24ca3952bbed5f20751c0cb99fc498999cb23d61972e826bad32dda60f7b5

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2023, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c32564f4f1400a45adebb85013fca0e.exe
Size 508KB
Sample230119-jspblacd51
SHA256 76e24ca3952bbed5f20751c0cb99fc498999cb23d61972e826bad32dda60f7b5
MD5 4c32564f4f1400a45adebb85013fca0e
SHA1 2959002858f401d7ed99f450c9b47eaaa23dee4e
SHA512 04c0d46431bd54824c925417776d15b4706d529083f6ccbeedb0dcef0571c7b1fe3eed9d68e8cc1ed5bc767016da9801bb96cfd7996e4e2d10628763e85f9f1a
SSDEEP 6144:cYa6OHHJBClPpcq7MDTvB069Tl8IHcsC74VEjZBqzuI/4gKsv6TNDURcIWzjMSmd:cYAHHyzpgPv73H6SEt6u2/6FURcIAj6l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

favgrandson7.sytes.net:2500
127.0.0.1:2500

Mutex

f84acc99-4ee4-4bae-b0e7-75cfd51b66bd

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-10-25T18:05:52.427403836Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2500
default_group
JAN132023
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f84acc99-4ee4-4bae-b0e7-75cfd51b66bd
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
favgrandson7.sytes.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
4856	fofekmg.exe
3696	fofekmg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	fofekmg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fofekmg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 3696	4856	fofekmg.exe	81

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	fofekmg.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	fofekmg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3448	schtasks.exe
2092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3696	fofekmg.exe
3696	fofekmg.exe
3696	fofekmg.exe
3696	fofekmg.exe
3696	fofekmg.exe
3696	fofekmg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3696	fofekmg.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4856	fofekmg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	fofekmg.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4856	4600	4c32564f4f1400a45adebb85013fca0e.exe	80
PID 4600 wrote to memory of 4856	4600	4c32564f4f1400a45adebb85013fca0e.exe	80
PID 4600 wrote to memory of 4856	4600	4c32564f4f1400a45adebb85013fca0e.exe	80
PID 4856 wrote to memory of 3696	4856	fofekmg.exe	81
PID 4856 wrote to memory of 3696	4856	fofekmg.exe	81
PID 4856 wrote to memory of 3696	4856	fofekmg.exe	81
PID 4856 wrote to memory of 3696	4856	fofekmg.exe	81
PID 3696 wrote to memory of 2092	3696	fofekmg.exe	84
PID 3696 wrote to memory of 2092	3696	fofekmg.exe	84
PID 3696 wrote to memory of 2092	3696	fofekmg.exe	84
PID 3696 wrote to memory of 3448	3696	fofekmg.exe	86
PID 3696 wrote to memory of 3448	3696	fofekmg.exe	86
PID 3696 wrote to memory of 3448	3696	fofekmg.exe	86

C:\Users\Admin\AppData\Local\Temp\4c32564f4f1400a45adebb85013fca0e.exe
"C:\Users\Admin\AppData\Local\Temp\4c32564f4f1400a45adebb85013fca0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\fofekmg.exe
  "C:\Users\Admin\AppData\Local\Temp\fofekmg.exe" C:\Users\Admin\AppData\Local\Temp\hbwshyhwrnr.yeu
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\fofekmg.exe
    "C:\Users\Admin\AppData\Local\Temp\fofekmg.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6055.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2092
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6140.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fofekmg.exe

Path C:\Users\Admin\AppData\Local\Temp\fofekmg.exe
Size 50KB
SHA256 48d4e3b9be5c21d003976f13cbb04b3f3660d2458ae7922c114d48434b36da75
MD5 86b58ab5eff1f42a0d42d6bee4193eb3
SHA1 e7c74b8db9c764e022991288e5d2b018087a27a8
SHA512 591543deff319b9101969a227aba12eb2333a96748b9e5017841b37a4ce83e23a37e33fab994fce191143dac095a6d735e20d7d9ad850b65269393ca336d2d42
SSDEEP 768:7ghRVbO+GDnPsEs6/9Ky3KmbY9FEhKNbGVNKQ5cz/qiXaNKBWJyCysQT+l:AxGDnPQsUbuNHe7qiLVLh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fofekmg.exe

Path C:\Users\Admin\AppData\Local\Temp\fofekmg.exe
Size 50KB
SHA256 48d4e3b9be5c21d003976f13cbb04b3f3660d2458ae7922c114d48434b36da75
MD5 86b58ab5eff1f42a0d42d6bee4193eb3
SHA1 e7c74b8db9c764e022991288e5d2b018087a27a8
SHA512 591543deff319b9101969a227aba12eb2333a96748b9e5017841b37a4ce83e23a37e33fab994fce191143dac095a6d735e20d7d9ad850b65269393ca336d2d42
SSDEEP 768:7ghRVbO+GDnPsEs6/9Ky3KmbY9FEhKNbGVNKQ5cz/qiXaNKBWJyCysQT+l:AxGDnPQsUbuNHe7qiLVLh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fofekmg.exe

Path C:\Users\Admin\AppData\Local\Temp\fofekmg.exe
Size 50KB
SHA256 48d4e3b9be5c21d003976f13cbb04b3f3660d2458ae7922c114d48434b36da75
MD5 86b58ab5eff1f42a0d42d6bee4193eb3
SHA1 e7c74b8db9c764e022991288e5d2b018087a27a8
SHA512 591543deff319b9101969a227aba12eb2333a96748b9e5017841b37a4ce83e23a37e33fab994fce191143dac095a6d735e20d7d9ad850b65269393ca336d2d42
SSDEEP 768:7ghRVbO+GDnPsEs6/9Ky3KmbY9FEhKNbGVNKQ5cz/qiXaNKBWJyCysQT+l:AxGDnPQsUbuNHe7qiLVLh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbwshyhwrnr.yeu

Path C:\Users\Admin\AppData\Local\Temp\hbwshyhwrnr.yeu
Size 5KB
SHA256 8ed9ad4097d7b970334a93ae2b3d07b8227f49d6a4171b0ab9d6066124c4d783
MD5 d1c28bc2d64571f4c63228844d8b6dda
SHA1 3fbdfbd2b4319fc63d58c002d8f3593e273f4007
SHA512 f4b97cbe8c64ddbd43c09bcb46fee8848b54abea1fad78a9a880e9e3066c855328fda7d1fbc4bbe32bbf7d5d411ff2c285b5aff3e12dc0a9b9ca7ee67df0bf4d
SSDEEP 96:Farc6oYZg/DrYuPk2XO5oSwQd8Fv3CU/Cdr1TQHky7K+WFAmqMxdjb5xXIf/3AV9:FarcRBXhX1S16Fv3P/er1TQHf7Ke74d5
MD5 SHA1 SHA512 SSDEEP

Submit Download

rlnervgdmli.yo

Path C:\Users\Admin\AppData\Local\Temp\rlnervgdmli.yo
Size 301KB
SHA256 9489989e06341f4af974da98b867ce439945c6b3263cc3d1e27e8325dde93467
MD5 53435a0b9695aa553839d873ccf124f0
SHA1 838f413f76af065f2ff09e61dc98b6bb3bca33ad
SHA512 1b797afd9b0192d3814252d731af6de1709f33d2a81684a394f8fabc5c28851da4ee44b70e1e2c4a4e4916216fa3773d9e1868d7dcd4e0729f6b55f03d42fef6
SSDEEP 6144:0kVVrwiGD4Y7rYKjclp5N912XoGXCAEuLK10+3M7HI9cxXLYE3cuE:JfjHIsOcP5N912XoGXZEuLI9M768XLYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp6055.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6055.tmp
Size 1KB
SHA256 3c13873871d5b1b90842d6b792efefc9eb0040bca54865cfde691512ee628c68
MD5 55773912a5cdd054719bb60343c3188c
SHA1 3c20ed083da86f0f3ad717b6688d8a8afb100436
SHA512 220888473bd8137b92931402ea754e1395a0563b82b26b492069506a1328cc32a74e520f6dc8269c2398c5ba1e0b3d9209ade4a5651211843ecc941be7856b9a
MD5 SHA1 SHA512

Submit Download

tmp6140.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6140.tmp
Size 1KB
SHA256 062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
MD5 4b7ef560289c0f62d0baf6f14f48a57a
SHA1 8331acb90dde588aa3196919f6e847f398fd06d1
SHA512 ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8
MD5 SHA1 SHA512

Submit Download

memory/3696-140-0x0000000004FD0000-0x0000000005062000-memory.dmp

Download

memory/3696-141-0x0000000005070000-0x000000000510C000-memory.dmp

Download

memory/3696-142-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/3696-143-0x0000000005150000-0x000000000515A000-memory.dmp

Download

memory/3696-139-0x0000000004A20000-0x0000000004FC4000-memory.dmp

Download

memory/3696-148-0x0000000006450000-0x00000000064B6000-memory.dmp

Download