nanocore | e0e80715b69be95f22d58f621c8e1aa0787fe7975ffa826276f4f5372418f554

General

Target

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
Size

370KB
MD5

ccd867cfc63db17919a2f33ad9f62c12
SHA1

59c080b507881b4eabbc6cd8cd017aa00efe51f2
SHA256

e0e80715b69be95f22d58f621c8e1aa0787fe7975ffa826276f4f5372418f554
SHA512

a90a4ab3bf79d1655a87840f0f2096eba68e895e9b1e9b84f2473ebcf076798f5e296b260c937e8e7f7d7d3a69cda928722818521116972d5da60c2dc5429f5a
SSDEEP

6144:tld+RZFkKF5SQBqZq80T4vzTvhM2dOEpPOBVZcA3NjXgU9lKKrsypc/xlf:tldKZeYwfbX3d5O1R9jXdlKOTmf

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

jeffserver.duckdns.org:7788

Mutex

d42d2ae0-373b-4f39-a3bc-ff7b345278dd

Attributes

activate_away_mode
true
backup_connection_host
jeffserver.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-08-03T22:28:43.558185736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7788
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
d42d2ae0-373b-4f39-a3bc-ff7b345278dd
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
jeffserver.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

description	pid	process	target process
PID 1976 set thread context of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

468 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

pid process

976 E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
976 E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

pid process

976 E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

description pid process

Token: SeDebugPrivilege 976 E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

pid	process
468	schtasks.exe

pid	process
976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

pid	process
976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

description	pid	process
Token: SeDebugPrivilege	976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

description	pid	process	target process
PID 1976 wrote to memory of 468	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	schtasks.exe
PID 1976 wrote to memory of 468	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	schtasks.exe
PID 1976 wrote to memory of 468	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	schtasks.exe
PID 1976 wrote to memory of 468	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	schtasks.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
PID 1976 wrote to memory of 976	1976	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe	E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe

C:\Users\Admin\AppData\Local\Temp\E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
"C:\Users\Admin\AppData\Local\Temp\E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NUNVjrF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp436.tmp"
2⤵
- Creates scheduled task(s)
PID:468

C:\Users\Admin\AppData\Local\Temp\E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe
"C:\Users\Admin\AppData\Local\Temp\E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp436.tmp
Filesize
1KB

MD5
6e0bf4eb51647e95f68dc14cdce4506b

SHA1
942e8883413bae7d34171b9ef033717f67c160ea

SHA256
9bdef4b754a8a95710185265f873e59aa96c20b43b323ed1fef9238302c80135

SHA512
417ba41ed21d050d87be4606e54beb98845c1c086fdadd0af7dde2b277802a7e154f037c439a053f7701b6091b3e12fe1671f8b320ee3cd27aa88c696005dcb0

Download Submit
memory/976-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/976-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/976-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/976-79-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/976-78-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/976-77-0x00000000004B0000-0x00000000004CE000-memory.dmp

Filesize
120KB

Download
memory/976-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/976-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/976-76-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/976-80-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/976-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/976-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/976-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1976-56-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1976-57-0x00000000005C0000-0x000000000060C000-memory.dmp

Filesize
304KB

Download
memory/1976-64-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/1976-55-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/1976-58-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/1976-54-0x00000000002F0000-0x0000000000352000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads