nanocore | 1022fd7bb8a53db67ec92455655a5e6306e26c5fde15db264e8bae312c6cf36b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc file.js
Size 615KB
Sample230214-w2mkksfc22
SHA256 1022fd7bb8a53db67ec92455655a5e6306e26c5fde15db264e8bae312c6cf36b
MD5 931fc81cbe6c2708a24936b6617f70c0
SHA1 a6d6a908909bfed414e8d6dc283750587208727d
SHA512 64552f5ac6da5130830f84c7963bef9a03a6654cb9678d78f4dfea80de7ec1051a19cde8d1a8f3195f05d273b5ecc53654359defa0d5aa39e84d7c3f9c6d65d4
SSDEEP 12288:FSKFi9mnp67w8LVbtuXshJ4nwFRqwEtOjG:FSKcmk88LbvgwzqRtj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

zafar101.duckdns.org:8779

Mutex

f3e2761c-8ffb-415b-b6b5-024a2ef9ff3e

Attributes

activate_away_mode
true
backup_connection_host
zafar101.duckdns.org
backup_dns_server
zafar101.duckdns.org
buffer_size
65535
build_time
2022-08-13T10:33:19.772981836Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8779
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f3e2761c-8ffb-415b-b6b5-024a2ef9ff3e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
zafar101.duckdns.org
primary_dns_server
zafar101.duckdns.org
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3184	doc file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3184 set thread context of 4028	3184	doc file.exe	83

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3140	schtasks.exe
1352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4028	RegSvcs.exe
4028	RegSvcs.exe
4028	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4028	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3184	doc file.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3184	4680	wscript.exe	82
PID 4680 wrote to memory of 3184	4680	wscript.exe	82
PID 4680 wrote to memory of 3184	4680	wscript.exe	82
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 3184 wrote to memory of 4028	3184	doc file.exe	83
PID 4028 wrote to memory of 3140	4028	RegSvcs.exe	84
PID 4028 wrote to memory of 3140	4028	RegSvcs.exe	84
PID 4028 wrote to memory of 3140	4028	RegSvcs.exe	84
PID 4028 wrote to memory of 1352	4028	RegSvcs.exe	86
PID 4028 wrote to memory of 1352	4028	RegSvcs.exe	86
PID 4028 wrote to memory of 1352	4028	RegSvcs.exe	86

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\doc file.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Roaming\doc file.exe
  "C:\Users\Admin\AppData\Roaming\doc file.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp832F.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3140
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp83BC.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp832F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp832F.tmp
Size 1KB
SHA256 3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c
MD5 8cad1b41587ced0f1e74396794f31d58
SHA1 11054bf74fcf5e8e412768035e4dae43aa7b710f
SHA512 99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef
MD5 SHA1 SHA512

Submit Download

tmp83BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp83BC.tmp
Size 1KB
SHA256 062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
MD5 4b7ef560289c0f62d0baf6f14f48a57a
SHA1 8331acb90dde588aa3196919f6e847f398fd06d1
SHA512 ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8
MD5 SHA1 SHA512

Submit Download

doc file.exe

Path C:\Users\Admin\AppData\Roaming\doc file.exe
Size 461KB
SHA256 765cbbbb41b433ad23ad00c37e06f2f0df134518f174f563ce71542bb54b4bef
MD5 5c1b6e8b6457c4c20025b35f84a3b4cb
SHA1 78a29561ed2069fd539e06606b1b6dd93a24f0d1
SHA512 674a09252391f01b70ab931b930d7f05fd8b1879c5ecea8cd89482cf34dfb991a9ba735952b323e4f839601f45d85f4bdad91d70fc08f8aa5d28822f543124c4
SSDEEP 12288:snaTZ1Yqu84rYqFPrGkEgiyiZ+/RTuRhtd:snKNu8qYszGkEHkMtd
MD5 SHA1 SHA512 SSDEEP

Submit Download

doc file.exe

Path C:\Users\Admin\AppData\Roaming\doc file.exe
Size 461KB
SHA256 765cbbbb41b433ad23ad00c37e06f2f0df134518f174f563ce71542bb54b4bef
MD5 5c1b6e8b6457c4c20025b35f84a3b4cb
SHA1 78a29561ed2069fd539e06606b1b6dd93a24f0d1
SHA512 674a09252391f01b70ab931b930d7f05fd8b1879c5ecea8cd89482cf34dfb991a9ba735952b323e4f839601f45d85f4bdad91d70fc08f8aa5d28822f543124c4
SSDEEP 12288:snaTZ1Yqu84rYqFPrGkEgiyiZ+/RTuRhtd:snKNu8qYszGkEHkMtd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4028-142-0x0000000005890000-0x000000000589A000-memory.dmp

Download

memory/4028-141-0x0000000005910000-0x00000000059AC000-memory.dmp

Download

memory/4028-140-0x00000000057D0000-0x0000000005862000-memory.dmp

Download

memory/4028-139-0x0000000005CC0000-0x0000000006264000-memory.dmp

Download

memory/4028-138-0x0000000000400000-0x0000000000438000-memory.dmp

Download