nanocore | cf1bc0e51ec2afbec5cffa1cf38e5ddcb6f9ce3aec8b737a55c8700600aa8caa

Analysis

max time kernel
141s
max time network
152s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0473350311911207E·pdf.exe
Size 1.0MB
Sample230712-g8clmacb96
SHA256 cf1bc0e51ec2afbec5cffa1cf38e5ddcb6f9ce3aec8b737a55c8700600aa8caa
MD5 3db6b2e92ac7aa0b1159eb451c15d4c7
SHA1 3f1ef725082b63c51266d353a8fc6a44f589a66e
SHA512 e3908bc6a306b5139d7dbc7cd8d18edff6eda5d142feaf6ac2658cef134a8029f92db6e9563ccfbf571c012ad5fa80f8895ad4011706d690dcfd363aeec133fd
SSDEEP 24576:whlXr7DeTgcS2MF9UqWjuGprRsADyYYMZH10frKp7nYB10hAA:GXqTgxSzjuieW914B1I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

wqqkgzmrdwxl8j.duckdns.org:23591

Mutex

f6afab64-873f-4d56-b17f-ef348c8e338e

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
wqqkgzmrdwxl8j.duckdns.org
buffer_size
65535
build_time
2023-04-14T14:06:46.875087636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
23591
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f6afab64-873f-4d56-b17f-ef348c8e338e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
wqqkgzmrdwxl8j.duckdns.org
primary_dns_server
wqqkgzmrdwxl8j.duckdns.org
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	0473350311911207E·pdf.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

pid	Process
2336	0473350311911207E·pdf.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	caspol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Autoriseringerne.exe"	caspol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe"	caspol.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2396	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2336	0473350311911207E·pdf.exe
2396	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 2396	2336	0473350311911207E·pdf.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe	caspol.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisvc.exe	caspol.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\statshemmeligheds.zir	0473350311911207E·pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2120	schtasks.exe
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2396	caspol.exe
2396	caspol.exe
2396	caspol.exe
2396	caspol.exe
2396	caspol.exe
2396	caspol.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2396	caspol.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2336	0473350311911207E·pdf.exe
2336	0473350311911207E·pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	caspol.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1868	2336	0473350311911207E·pdf.exe	29
PID 2336 wrote to memory of 1868	2336	0473350311911207E·pdf.exe	29
PID 2336 wrote to memory of 1868	2336	0473350311911207E·pdf.exe	29
PID 2336 wrote to memory of 1868	2336	0473350311911207E·pdf.exe	29
PID 2336 wrote to memory of 2396	2336	0473350311911207E·pdf.exe	30
PID 2336 wrote to memory of 2396	2336	0473350311911207E·pdf.exe	30
PID 2336 wrote to memory of 2396	2336	0473350311911207E·pdf.exe	30
PID 2336 wrote to memory of 2396	2336	0473350311911207E·pdf.exe	30
PID 2336 wrote to memory of 2396	2336	0473350311911207E·pdf.exe	30
PID 2396 wrote to memory of 2120	2396	caspol.exe	33
PID 2396 wrote to memory of 2120	2396	caspol.exe	33
PID 2396 wrote to memory of 2120	2396	caspol.exe	33
PID 2396 wrote to memory of 2120	2396	caspol.exe	33
PID 2396 wrote to memory of 3052	2396	caspol.exe	35
PID 2396 wrote to memory of 3052	2396	caspol.exe	35
PID 2396 wrote to memory of 3052	2396	caspol.exe	35
PID 2396 wrote to memory of 3052	2396	caspol.exe	35

C:\Users\Admin\AppData\Local\Temp\0473350311911207E·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\0473350311911207E·pdf.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\0473350311911207E·pdf.exe"
  2⤵
  PID:1868
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\0473350311911207E·pdf.exe"
  2⤵
  - Checks QEMU agent file
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE0FF.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2120
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE229.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpE0FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE0FF.tmp
Size 1KB
SHA256 3462cbe62fbb64fc53a0fcf97e43baafe9dd9929204f586a86afe4b89d8048a6
MD5 497f298fc157762f192a7c42854c6fb6
SHA1 04bec630f5cc64ea17c0e3e780b3ccf15a35c6e0
SHA512 c7c6fd3097f4d1ccd313160fedf7cb031644e0836b8c3e25481095e5f4b003759bc84fc6ea9421e3a090e66dc2ff875fec2f394a386691ab178cb164733411b2
MD5 SHA1 SHA512

Submit Download

tmpE229.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE229.tmp
Size 1KB
SHA256 e82a4b8311319f1b68cb06ae5b670e97a11c467b1bdb0ebf130f523bf98ca522
MD5 0d6d94a917c4ce63da6bc50cbbe0dc5d
SHA1 599564f60649f3f4c14478e9cb184000d4280a61
SHA512 23ac6a088e2a1df3d75d2aca17cdcc5a4147b966758e4acc4d904293f4693f362db637d8135edd670e158bec77e788e915f2a55042a2f1aec09a4679bc749412
MD5 SHA1 SHA512

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nso4D4.tmp\System.dll
Size 11KB
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2396-69-0x0000000000400000-0x0000000000615000-memory.dmp

Download

memory/2396-90-0x0000000000400000-0x0000000000615000-memory.dmp

Download

memory/2396-92-0x0000000000A20000-0x0000000003EAD000-memory.dmp

Download

memory/2396-93-0x0000000034240000-0x0000000034280000-memory.dmp

Download

memory/2396-102-0x0000000034240000-0x0000000034280000-memory.dmp

Download

memory/2396-103-0x0000000034240000-0x0000000034280000-memory.dmp

Download

memory/2396-107-0x0000000034240000-0x0000000034280000-memory.dmp

Download