nanocore | 2ef9e0b5a402e96b775bb1701741bb8af269dd6346b96827681da12912a55b8a

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bd6af6f395bd4d577b0d3c97bc58195.scr.exe
Size

1.1MB
MD5

b15216131833ae02f4f05d5bb4dfea43
SHA1

dc09861f62b55e50be77a1588a997adf9b80e410
SHA256

2ef9e0b5a402e96b775bb1701741bb8af269dd6346b96827681da12912a55b8a
SHA512

85961d8b04687f7cb70eecce082e82198fcdbb6093a1ef34f8fe12a69b41c3f3cc05e388162d3d89f160fa63e807d62a6a5fefd1587db44d0f27c1bd8a107633
SSDEEP

24576:lTbBv5rUaUUUUUJUUUUUUJDDpvm6tTjloM8WZQ6k+5zUMel:PBLUUUUUJUUUUUUFDpvYMdqwFUMM

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

december2n.duckdns.org:40111

december2nd.ddns.net:40111

Mutex

32ca6e6e-2fe0-4ef5-a3ea-5de451e80042

Attributes

activate_away_mode
false
backup_connection_host
december2nd.ddns.net
backup_dns_server
buffer_size
65538
build_time
2022-11-26T05:13:34.059050336Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
40111
default_group
mama
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
32ca6e6e-2fe0-4ef5-a3ea-5de451e80042
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
december2n.duckdns.org
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5bd6af6f395bd4d577b0d3c97bc58195.scr.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	5bd6af6f395bd4d577b0d3c97bc58195.scr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

Processes:

shaggugwvk.pifRegSvcs.exe

pid process

3996 shaggugwvk.pif
1960 RegSvcs.exe

pid	process
3996	shaggugwvk.pif
1960	RegSvcs.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

shaggugwvk.pifRegSvcs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	shaggugwvk.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ppfr\\SHAGGU~1.PIF C:\\Users\\Admin\\AppData\\Local\\Temp\\ppfr\\jmapn.msc"	shaggugwvk.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ppfr\\Update.vbs"	shaggugwvk.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Host = "C:\\Program Files (x86)\\UPNP Host\\upnphost.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegSvcs.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

shaggugwvk.pif

description pid process target process

PID 3996 set thread context of 1960 3996 shaggugwvk.pif RegSvcs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

description	pid	process	target process
PID 3996 set thread context of 1960	3996	shaggugwvk.pif	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Program Files (x86)\UPNP Host\upnphost.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\UPNP Host\upnphost.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4836 schtasks.exe
4488 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

RegSvcs.exe

pid process

1960 RegSvcs.exe
1960 RegSvcs.exe
1960 RegSvcs.exe
1960 RegSvcs.exe
1960 RegSvcs.exe
1960 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

1960 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1960 RegSvcs.exe
Token: SeDebugPrivilege 1960 RegSvcs.exe
Token: SeDebugPrivilege 1960 RegSvcs.exe

pid	process
4836	schtasks.exe
4488	schtasks.exe

pid	process
1960	RegSvcs.exe
1960	RegSvcs.exe
1960	RegSvcs.exe
1960	RegSvcs.exe
1960	RegSvcs.exe
1960	RegSvcs.exe

pid	process
1960	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1960	RegSvcs.exe
Token: SeDebugPrivilege	1960	RegSvcs.exe
Token: SeDebugPrivilege	1960	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

5bd6af6f395bd4d577b0d3c97bc58195.scr.exewscript.exeshaggugwvk.pifRegSvcs.exe

description	pid	process	target process
PID 2804 wrote to memory of 4532	2804	5bd6af6f395bd4d577b0d3c97bc58195.scr.exe	wscript.exe
PID 2804 wrote to memory of 4532	2804	5bd6af6f395bd4d577b0d3c97bc58195.scr.exe	wscript.exe
PID 2804 wrote to memory of 4532	2804	5bd6af6f395bd4d577b0d3c97bc58195.scr.exe	wscript.exe
PID 4532 wrote to memory of 3996	4532	wscript.exe	shaggugwvk.pif
PID 4532 wrote to memory of 3996	4532	wscript.exe	shaggugwvk.pif
PID 4532 wrote to memory of 3996	4532	wscript.exe	shaggugwvk.pif
PID 3996 wrote to memory of 1960	3996	shaggugwvk.pif	RegSvcs.exe
PID 3996 wrote to memory of 1960	3996	shaggugwvk.pif	RegSvcs.exe
PID 3996 wrote to memory of 1960	3996	shaggugwvk.pif	RegSvcs.exe
PID 3996 wrote to memory of 1960	3996	shaggugwvk.pif	RegSvcs.exe
PID 3996 wrote to memory of 1960	3996	shaggugwvk.pif	RegSvcs.exe
PID 1960 wrote to memory of 4836	1960	RegSvcs.exe	schtasks.exe
PID 1960 wrote to memory of 4836	1960	RegSvcs.exe	schtasks.exe
PID 1960 wrote to memory of 4836	1960	RegSvcs.exe	schtasks.exe
PID 1960 wrote to memory of 4488	1960	RegSvcs.exe	schtasks.exe
PID 1960 wrote to memory of 4488	1960	RegSvcs.exe	schtasks.exe
PID 1960 wrote to memory of 4488	1960	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\5bd6af6f395bd4d577b0d3c97bc58195.scr.exe
"C:\Users\Admin\AppData\Local\Temp\5bd6af6f395bd4d577b0d3c97bc58195.scr.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" Update-db.q.vbe
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4532

C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
"C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif" jmapn.msc
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3996

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UPNP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB72F.tmp"
5⤵
- Creates scheduled task(s)
PID:4836

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UPNP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB849.tmp"
5⤵
- Creates scheduled task(s)
PID:4488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppfr\jmapn.msc
Filesize
83.2MB

MD5
027fcff6a3d87f462e20830ac8e3514f

SHA1
f8ccc5c999f380c02617dd9a342fb4e6f8aa1389

SHA256
0ebdc3485e0b7208f43d2cc85fa841f528f74fab9d3fd90ddbee1b4eff2e17d5

SHA512
cbc01e13eaf6619264a46b03237f8f84af0df364581252de45d8cee7ee0757afdac23e6a740e87f0817c660bad02163d4ef1ab3f76d10347f52406fe2e8e910d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppfr\mbmuovrk.vmb
Filesize
397KB

MD5
47a3760694424f080062061971c9e2ae

SHA1
107b8682b9322ee4886ade154c88c3cfebd24ae9

SHA256
2a454fbe70bedf8e9df6bb9172fd14b941b675a3465a80bc9b0fe20b499ef4ad

SHA512
31d92fc367c857fa71598fbb3346f292da574855d013a7cab0b5715eac80a7e2b37d863c92dcdb3b1ef34fc6e3529630460c9b23ba22e3d41e4553c5f3a3e655

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
Filesize
1.1MB

MD5
164ad61662d4c1689360b3e088f2152f

SHA1
c2a2e463a82845171f746d25932b25880d49f7fe

SHA256
1a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e

SHA512
c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppfr\shaggugwvk.pif
Filesize
1.1MB

MD5
164ad61662d4c1689360b3e088f2152f

SHA1
c2a2e463a82845171f746d25932b25880d49f7fe

SHA256
1a272f4a2a062cafb72904a1643de13acce81dd1adfc7da7d9873ec88dce431e

SHA512
c48c0698bdabc7d7eefa5dc239d9baa43334a64bd4b01b1a0243e873124b01bc5e8d46ef421b888850fe5666e1c4585014254fe32c25463fe71bd2775ae043cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppfr\vjmptakx.icm
Filesize
37KB

MD5
ae0c231ca889212f0bad108625ad4514

SHA1
a9bce3322991fcf993ad466ea78637eecd624db9

SHA256
7c11fef67f06f18a2d5a949029c9ac362f40cd3f1f13e74336473fd65d327a42

SHA512
5016270c7493360d8019e074e2e3c8382eea4384b63ea188ecf6a97d45a706f0a3d3621071479b3f15bb0e596dbc376c8d9d8c99d269e063fed046e621be18d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB72F.tmp
Filesize
1KB

MD5
95aceabc58acad5d73372b0966ee1b35

SHA1
2293b7ad4793cf574b1a5220e85f329b5601040a

SHA256
8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4

SHA512
00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB849.tmp
Filesize
1KB

MD5
88bf0bc1e20b64333f39f1cf2085a729

SHA1
6d8eeef3d8f118ded3f2f1dc55ffaa71ee5d7ad8

SHA256
393c769644b1c640753a6bab46cd6c8cbaf984d116d6f7dd1a071d5f2afa42f9

SHA512
74dfacf7443b7b08da09d40bca1b2a99e7dc44d9d5289f86e1b718f3268b1b11e85c04eb8dd0a5e95788726f09678051a27902d509f015a5ff6609c7d8ec9aba

Download Submit
C:\Users\Admin\AppData\Local\temp\ppfr\Update-db.q.vbe
Filesize
60KB

MD5
adf0a90a776e28ce256b5bcef92dc40c

SHA1
85d5b78d08df5ab38a70ac372dda075424f1a886

SHA256
ee53ad078ffa7b36eb1f71f5a4dfdb5e945c4aad6d8af78bf780be19c27c3ee7

SHA512
078c3b432854aa9d0bd0673e60e0515e2a9e35e70f826835424ac7da76ba48c8dd3840b5960cfab6149d3739e5c35744f3628a2f08523033c6b0a1addb8ab410

Download Submit
memory/1960-216-0x0000000000B00000-0x0000000001086000-memory.dmp

Filesize
5.5MB

Download
memory/1960-219-0x0000000000B00000-0x0000000000B3A000-memory.dmp

Filesize
232KB

Download
memory/1960-220-0x0000000005BC0000-0x0000000006164000-memory.dmp

Filesize
5.6MB

Download
memory/1960-221-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/1960-222-0x0000000005750000-0x00000000057EC000-memory.dmp

Filesize
624KB

Download
memory/1960-223-0x00000000056C0000-0x00000000056CA000-memory.dmp

Filesize
40KB

Download
memory/1960-230-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/1960-234-0x00000000071B0000-0x0000000007216000-memory.dmp

Filesize
408KB

Download
memory/1960-236-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download