nanocore | 9f55706283a4dc416a8b10d99d5bbea1a8df5ee67d6bb0caf35e8d942678d84d

General

Target

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
Size

1001KB
MD5

0824bc52c4133691364453dd4d2143ba
SHA1

0e5119f96e2071c64e97f0ad689c89ae5caae2dd
SHA256

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8
SHA512

02268cc1f1d596bc87196a85c45bbe355d8b7c2336c06beed9bcfa60b920e05a32797937d6d089d5b8db4d5c25c3625bcfcce19addc680678095679ad3f0db91
SSDEEP

24576:51bgzPGhgzfYdwMYedHwioX47BaeSavf7QetqZ:5ZyPyywdwMYeSiqqocAZ

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

atelilian99.ddns.net:8282

127.0.0.1:8282

Mutex

9fd663d5-0621-4e90-b695-1bb0b18ad354

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2022-11-16T09:14:15.335338636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8282
default_group
Multi
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9fd663d5-0621-4e90-b695-1bb0b18ad354
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
atelilian99.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 37.235.1.174
Destination IP 37.235.1.177
Destination IP 37.235.1.177
Destination IP 37.235.1.174

description	ioc
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.177
Destination IP	37.235.1.174

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Subsystem = "C:\\Program Files (x86)\\ARP Subsystem\\arpss.exe"	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

description	pid	process	target process
PID 1740 set thread context of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Drops file in Program Files directory 2 IoCs

Processes:

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

description	ioc	process
File created	C:\Program Files (x86)\ARP Subsystem\arpss.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
File opened for modification	C:\Program Files (x86)\ARP Subsystem\arpss.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

984 schtasks.exe

pid	process
984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

pid	process
580	powershell.exe
568	powershell.exe
1796	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
1796	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
1796	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

pid process

1796 94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

pid	process
1796	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exe94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

description	pid	process
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	1796	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

description	pid	process	target process
PID 1740 wrote to memory of 568	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 568	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 568	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 568	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 580	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 580	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 580	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 580	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	powershell.exe
PID 1740 wrote to memory of 984	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	schtasks.exe
PID 1740 wrote to memory of 984	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	schtasks.exe
PID 1740 wrote to memory of 984	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	schtasks.exe
PID 1740 wrote to memory of 984	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	schtasks.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
PID 1740 wrote to memory of 1796	1740	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe	94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe

C:\Users\Admin\AppData\Local\Temp\94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
"C:\Users\Admin\AppData\Local\Temp\94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nQvRCv.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nQvRCv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB79D.tmp"
2⤵
- Creates scheduled task(s)
PID:984

C:\Users\Admin\AppData\Local\Temp\94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe
"C:\Users\Admin\AppData\Local\Temp\94b9fd8d1d160e47e7a963d8d65d29486f023a0fe21180d16480342f0b53b5a8.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB79D.tmp
Filesize
1KB

MD5
6d98b0b981f4a1da2033dd87f6466b8a

SHA1
328ac1f1c428282b6684a4ff8aad0f93dd2bb75a

SHA256
a3ea914ad2a3ec42a78178340f5dde874819a5764c1fd8acf0e48678e659c656

SHA512
7c6106825c3ac33e98b3f00f459c9790ac34ddb829bdaa11b19ad04b3e0f9680ca607b69a0b42591129ad2d8d388b8708c3bbd8e0384277d992a20055887246d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6DQNXKZ0P1D47CNWAJZX.temp
Filesize
7KB

MD5
43216df181445651ea94269602f9da9a

SHA1
1aa55af1edeca74d35d39cead9524b3222367398

SHA256
ce3ec34efe90dc962ef73f9c667f97d729dab9ab8b82f0eefef5a360d808a2f4

SHA512
37e7b2d87defd7a0b7949e11817574f72ba0b4ae0bd467a5564a485f07d74895f5cb04c768dcf7549ff22778861186e5fda372f46a2119d62cc694eff440a3ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
43216df181445651ea94269602f9da9a

SHA1
1aa55af1edeca74d35d39cead9524b3222367398

SHA256
ce3ec34efe90dc962ef73f9c667f97d729dab9ab8b82f0eefef5a360d808a2f4

SHA512
37e7b2d87defd7a0b7949e11817574f72ba0b4ae0bd467a5564a485f07d74895f5cb04c768dcf7549ff22778861186e5fda372f46a2119d62cc694eff440a3ef

Download Submit
memory/568-89-0x0000000002310000-0x0000000002350000-memory.dmp

Filesize
256KB

Download
memory/568-90-0x0000000002310000-0x0000000002350000-memory.dmp

Filesize
256KB

Download
memory/580-88-0x0000000002530000-0x0000000002570000-memory.dmp

Filesize
256KB

Download
memory/1740-57-0x0000000002220000-0x0000000002260000-memory.dmp

Filesize
256KB

Download
memory/1740-59-0x0000000007D70000-0x0000000007E06000-memory.dmp

Filesize
600KB

Download
memory/1740-58-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/1740-72-0x00000000050A0000-0x00000000050DC000-memory.dmp

Filesize
240KB

Download
memory/1740-56-0x00000000001E0000-0x00000000001F4000-memory.dmp

Filesize
80KB

Download
memory/1740-55-0x0000000002220000-0x0000000002260000-memory.dmp

Filesize
256KB

Download
memory/1740-54-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/1796-78-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-80-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-82-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-85-0x0000000000620000-0x000000000062A000-memory.dmp

Filesize
40KB

Download
memory/1796-86-0x0000000000730000-0x000000000074E000-memory.dmp

Filesize
120KB

Download
memory/1796-87-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/1796-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1796-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads