nanocore | aeaa1d0b93a6bb7b94c8afcea3c4f33558a94b6543974bbe51ce422c9ab99d5a

General

Target

0aec457469de534eb2074e96c24021f7.exe
Size

172KB
MD5

0aec457469de534eb2074e96c24021f7
SHA1

d673cbb5793dac7f65a5a4884af82626ae502f91
SHA256

aeaa1d0b93a6bb7b94c8afcea3c4f33558a94b6543974bbe51ce422c9ab99d5a
SHA512

e09a531c5fd4d0164fdde21260c7be432e5806bc2e6d6e78cd7f074c9ac4d7f525b726ef6bcb0900e6ab9d276ff7cb734210c452120a7bb76d053740c6d46c0d
SSDEEP

1536:G7gS9eobM4pqrOjRrpqcmvIADTdt2xrMS89X5+PEflS:89eyJpqrOjlpqrvIADTdt2xMj5+PwE

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

freetime.accesscam.org:511

Mutex

2a2b4624-7063-4c2d-a0bc-6a686f1869af

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-11-21T04:59:10.673908136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
511
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2a2b4624-7063-4c2d-a0bc-6a686f1869af
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
freetime.accesscam.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{PX89TUI9-611648-WD891A-WD891AP9P9}.exe	AAM Updates Notifier.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{PX89TUI9-611648-WD891A-WD891AP9P9}.exe	AAM Updates Notifier.exe

Executes dropped EXE 2 IoCs

pid	Process
2040	AAM Updates Notifier.exe
1980	12658699.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Manager = "C:\\Program Files (x86)\\AGP Manager\\agpmgr.exe"	12658699.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{PX89TUI9-611648-WD891A-WD891AP9P9} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AAM Updates Notifier.exe\" ..."	AAM Updates Notifier.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	12658699.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AGP Manager\agpmgr.exe	12658699.exe
File opened for modification	C:\Program Files (x86)\AGP Manager\agpmgr.exe	12658699.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1012	schtasks.exe
556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1980	12658699.exe
1980	12658699.exe
1980	12658699.exe
1980	12658699.exe
1980	12658699.exe
1980	12658699.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	12658699.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	12658699.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2040	1204	0aec457469de534eb2074e96c24021f7.exe	28
PID 1204 wrote to memory of 2040	1204	0aec457469de534eb2074e96c24021f7.exe	28
PID 1204 wrote to memory of 2040	1204	0aec457469de534eb2074e96c24021f7.exe	28
PID 2040 wrote to memory of 1980	2040	AAM Updates Notifier.exe	30
PID 2040 wrote to memory of 1980	2040	AAM Updates Notifier.exe	30
PID 2040 wrote to memory of 1980	2040	AAM Updates Notifier.exe	30
PID 2040 wrote to memory of 1980	2040	AAM Updates Notifier.exe	30
PID 1980 wrote to memory of 1012	1980	12658699.exe	31
PID 1980 wrote to memory of 1012	1980	12658699.exe	31
PID 1980 wrote to memory of 1012	1980	12658699.exe	31
PID 1980 wrote to memory of 1012	1980	12658699.exe	31
PID 1980 wrote to memory of 556	1980	12658699.exe	33
PID 1980 wrote to memory of 556	1980	12658699.exe	33
PID 1980 wrote to memory of 556	1980	12658699.exe	33
PID 1980 wrote to memory of 556	1980	12658699.exe	33

C:\Users\Admin\AppData\Local\Temp\0aec457469de534eb2074e96c24021f7.exe
"C:\Users\Admin\AppData\Local\Temp\0aec457469de534eb2074e96c24021f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\AAM Updates Notifier.exe
  "C:\Users\Admin\AppData\Local\Temp\AAM Updates Notifier.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\12658699.exe
    "C:\Users\Admin\AppData\Local\Temp\12658699.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "AGP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp94C2.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1012
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "AGP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp960A.tmp"
      4⤵
      Creates scheduled task(s)
      PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\12658699.exe

Filesize
203KB

MD5
08cf032318ab508c83b72fbc7c6a1062

SHA1
3eda60f7d8b905179d3c760670d7d2f4a53dc5fb

SHA256
8297e972cf743389cde4fc6dde7da5ecc48cbcb35e3240d03d116d75d4388d31

SHA512
5b34f855159f9ba95c883e98ca55cb1715e99b5812a112016a7e528900c61d7f0b629121a6b790751d114cf5ec9e2a6d0afac4773b3b5948d9027806d474cfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\12658699.exe

Filesize
203KB

MD5
08cf032318ab508c83b72fbc7c6a1062

SHA1
3eda60f7d8b905179d3c760670d7d2f4a53dc5fb

SHA256
8297e972cf743389cde4fc6dde7da5ecc48cbcb35e3240d03d116d75d4388d31

SHA512
5b34f855159f9ba95c883e98ca55cb1715e99b5812a112016a7e528900c61d7f0b629121a6b790751d114cf5ec9e2a6d0afac4773b3b5948d9027806d474cfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AAM Updates Notifier.exe

Filesize
172KB

MD5
0aec457469de534eb2074e96c24021f7

SHA1
d673cbb5793dac7f65a5a4884af82626ae502f91

SHA256
aeaa1d0b93a6bb7b94c8afcea3c4f33558a94b6543974bbe51ce422c9ab99d5a

SHA512
e09a531c5fd4d0164fdde21260c7be432e5806bc2e6d6e78cd7f074c9ac4d7f525b726ef6bcb0900e6ab9d276ff7cb734210c452120a7bb76d053740c6d46c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AAM Updates Notifier.exe

Filesize
172KB

MD5
0aec457469de534eb2074e96c24021f7

SHA1
d673cbb5793dac7f65a5a4884af82626ae502f91

SHA256
aeaa1d0b93a6bb7b94c8afcea3c4f33558a94b6543974bbe51ce422c9ab99d5a

SHA512
e09a531c5fd4d0164fdde21260c7be432e5806bc2e6d6e78cd7f074c9ac4d7f525b726ef6bcb0900e6ab9d276ff7cb734210c452120a7bb76d053740c6d46c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C2.tmp

Filesize
1KB

MD5
ada09e5a9ff4d6e9fba6533f970f701f

SHA1
9b7570fbd5efcb4198dc98fab333477f304af234

SHA256
df3df4d4a4560e9423ca39584795ce41927812d353bf6173afa068f29ae00b8f

SHA512
36aaa2cf615175dd16ee951af4196e85fe50c53de94e7c693ab0e7f5c2e72c57a2911a1fa60cc2b34cf5b8646d8edda7bd2d148faec3b56d2365bf23ec874106

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp960A.tmp

Filesize
1KB

MD5
885d6dd30570594e167fadb59d9ca0ea

SHA1
9981e583644c4eb9cf5056615a0e1c2913c8983b

SHA256
7155bc082d1713d77c2797575ee0ade8467fb7012f5376c1d6f4aa618141a7d2

SHA512
1623218143c2c25a7c85fa9da8e0f251f04a5eb848c4d0aa10bfb78688518b82393a2b3c7f287a9dc06a366ef9f46d0d4e2d246ad4cef4554a74c0bb6ff9dd2a

Download Submit
memory/1204-55-0x000007FEEEC10000-0x000007FEEFCA6000-memory.dmp

Filesize
16.6MB

Download
memory/1204-54-0x000007FEF4280000-0x000007FEF4CA3000-memory.dmp

Filesize
10.1MB

Download
memory/1980-66-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1980-71-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-72-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-62-0x0000000002036000-0x0000000002055000-memory.dmp

Filesize
124KB

Download
memory/2040-61-0x0000000002036000-0x0000000002055000-memory.dmp

Filesize
124KB

Download
memory/2040-60-0x000007FEEDB70000-0x000007FEEEC06000-memory.dmp

Filesize
16.6MB

Download
memory/2040-59-0x000007FEF4280000-0x000007FEF4CA3000-memory.dmp

Filesize
10.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads