nanocore | 0b525aaa05e206258e8e98f05fcc621a0c8d4df69138970a1447e57d157c6331

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA.exe
Size

757KB
MD5

6c432a8b26bc0e068f23e88f69c0f565
SHA1

318fdcf5ba0a326bf6601e1f917f9aa16645d9ca
SHA256

0b525aaa05e206258e8e98f05fcc621a0c8d4df69138970a1447e57d157c6331
SHA512

1a57c2c54e51a4e9bc1abf375a10e87236c5136cbbca0920597ecbf7f0d3bae674cced351ee5794028f7e7e25982bcb3409fc36d6ccf41b9497bbdec03a19c7e
SSDEEP

12288:faNp9CFWv60PaT5zePZMjFkA1pniuSwgsAaQWKYt9VRd4li8i+3UQXGLPSPr3FbV:SNp9CFEa4RMjFhThyaJj+N66z3F8+sW

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

ezemnia3.ddns.net:62335

91.193.75.178:62335

Mutex

954449b5-566c-46fe-92f0-8eb82a7f77b0

Attributes

activate_away_mode
true
backup_connection_host
91.193.75.178
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2023-01-23T18:14:17.620110936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
62335
default_group
Cashout
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
954449b5-566c-46fe-92f0-8eb82a7f77b0
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
ezemnia3.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Host = "C:\\Program Files (x86)\\UPNP Host\\upnphost.exe"	Caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3892 set thread context of 4436	3892	NA.exe	83

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UPNP Host\upnphost.exe	Caspol.exe
File opened for modification	C:\Program Files (x86)\UPNP Host\upnphost.exe	Caspol.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4436	Caspol.exe
4436	Caspol.exe
4436	Caspol.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	Caspol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	Caspol.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83
PID 3892 wrote to memory of 4436	3892	NA.exe	83

C:\Users\Admin\AppData\Local\Temp\NA.exe
"C:\Users\Admin\AppData\Local\Temp\NA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-133-0x0000022165A10000-0x0000022165AD2000-memory.dmp

Filesize
776KB

Download
memory/4436-134-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4436-136-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/4436-137-0x00000000053F0000-0x0000000005482000-memory.dmp

Filesize
584KB

Download
memory/4436-138-0x0000000005500000-0x000000000559C000-memory.dmp

Filesize
624KB

Download
memory/4436-139-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/4436-140-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/4436-143-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/4436-144-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/4436-145-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download