nanocore | 20b8f049494d33693b252a95fb0a556c5d4edca72144a41da1fc7e789e60b404

General

Target

ff8b9b806c42673b76b59e4d87222f4e.exe
Size

627KB
MD5

ff8b9b806c42673b76b59e4d87222f4e
SHA1

5ed9a0ed0709184a8fd58394962e29451c46b25d
SHA256

20b8f049494d33693b252a95fb0a556c5d4edca72144a41da1fc7e789e60b404
SHA512

65a64036e1fba41f97f512732986055feaf279484b153187414cb56216df41ef9c74197a453647387c6a1fa61cd97ecc9bc5bdbabcbbafcd11c53d05341648b7
SSDEEP

12288:9LbQeB2gOHbz4jWmkraLWSVrenx7oHDvmA06K+UUEIv4Dcig3YeLzJE0N:ZQY2jHbmiaq7x7Q26QX7oiTeLzG

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

tzitziklishop.ddns.net:1665

127.0.0.1:1665

Mutex

be28fce4-4930-4ffe-96ed-0110cf99b889

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-11-05T12:54:30.362923036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1665
default_group
SecureKMT
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
be28fce4-4930-4ffe-96ed-0110cf99b889
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tzitziklishop.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe"	ff8b9b806c42673b76b59e4d87222f4e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ff8b9b806c42673b76b59e4d87222f4e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Host\ddphost.exe	ff8b9b806c42673b76b59e4d87222f4e.exe
File opened for modification	C:\Program Files (x86)\DDP Host\ddphost.exe	ff8b9b806c42673b76b59e4d87222f4e.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3848	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3556	ff8b9b806c42673b76b59e4d87222f4e.exe
3556	ff8b9b806c42673b76b59e4d87222f4e.exe
3556	ff8b9b806c42673b76b59e4d87222f4e.exe
3556	ff8b9b806c42673b76b59e4d87222f4e.exe
3556	ff8b9b806c42673b76b59e4d87222f4e.exe
3556	ff8b9b806c42673b76b59e4d87222f4e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3556	ff8b9b806c42673b76b59e4d87222f4e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	ff8b9b806c42673b76b59e4d87222f4e.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 4648 wrote to memory of 3556	4648	ff8b9b806c42673b76b59e4d87222f4e.exe	88
PID 3556 wrote to memory of 3848	3556	ff8b9b806c42673b76b59e4d87222f4e.exe	89
PID 3556 wrote to memory of 3848	3556	ff8b9b806c42673b76b59e4d87222f4e.exe	89
PID 3556 wrote to memory of 3848	3556	ff8b9b806c42673b76b59e4d87222f4e.exe	89
PID 3556 wrote to memory of 3160	3556	ff8b9b806c42673b76b59e4d87222f4e.exe	91
PID 3556 wrote to memory of 3160	3556	ff8b9b806c42673b76b59e4d87222f4e.exe	91
PID 3556 wrote to memory of 3160	3556	ff8b9b806c42673b76b59e4d87222f4e.exe	91

C:\Users\Admin\AppData\Local\Temp\ff8b9b806c42673b76b59e4d87222f4e.exe
"C:\Users\Admin\AppData\Local\Temp\ff8b9b806c42673b76b59e4d87222f4e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\ff8b9b806c42673b76b59e4d87222f4e.exe
  "C:\Users\Admin\AppData\Local\Temp\ff8b9b806c42673b76b59e4d87222f4e.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1E36.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3848
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1EE3.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ff8b9b806c42673b76b59e4d87222f4e.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1E36.tmp

Filesize
1KB

MD5
c0792ae2f0bf0c103a40783bb08dab3e

SHA1
13f9509c942770b2b6830f57bd0cd20ef7ff2ff1

SHA256
324ba20f9293bb959a29ac0032c7bc67331f4f9b18ce585411c04deae1840607

SHA512
991896ff4ed15e10c81f041e69c03eab7fdfa3ee8c4db07ab28f0c97a66816ea690ae6da84bc119cb007583e4aa6ee846d2a828f4eaa18f5c9c4de85f2a13256

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1EE3.tmp

Filesize
1KB

MD5
2271642ca970891700e3f48439739ed8

SHA1
cd472df2349f7db9e1e460d0ee28acd97b8a8793

SHA256
7aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68

SHA512
4669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807

Download Submit
memory/3556-138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3556-144-0x0000000006E20000-0x0000000006E86000-memory.dmp

Filesize
408KB

Download
memory/4648-132-0x0000000000AA0000-0x0000000000B42000-memory.dmp

Filesize
648KB

Download
memory/4648-136-0x0000000007F60000-0x0000000007FFC000-memory.dmp

Filesize
624KB

Download
memory/4648-135-0x00000000054F0000-0x00000000054FA000-memory.dmp

Filesize
40KB

Download
memory/4648-134-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/4648-133-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads