nanocore | fc47abded46b7d8bc47322f8b12d8de5a6a003f0304fa00b6833f624a3c0eeb0

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6880d06f0b0a7f300b0f29fa28325d8c.exe
Size 1.5MB
Sample240119-yns7bacfeq
SHA256 fc47abded46b7d8bc47322f8b12d8de5a6a003f0304fa00b6833f624a3c0eeb0
MD5 6880d06f0b0a7f300b0f29fa28325d8c
SHA1 6255d4b496f5612406fc26dd5651dc1db056980b
SHA512 3f40c78f5b435d1db341687014b8ba49b807bc83db8067f865ba4aa60770f8858c4792f942d715625c7425b3024639379f9c36b448a6939873228f7ea442df26
SSDEEP 24576:HHxX39sVZtHtR1d0VP3obiVppm9E5bLu16/WpXHBIeLuMq0Rz8fjUJ3aE:t9sfruVAm78Su16OpX6IBq0RzKjUpa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

194.5.98.127:54984
127.0.0.1:54984

Mutex

7547b95a-3564-48ed-9de2-e9e7593fe923

Attributes

activate_away_mode
false
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-05-15T02:12:33.385073736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
ikenna
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7547b95a-3564-48ed-9de2-e9e7593fe923
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
194.5.98.127
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	6880d06f0b0a7f300b0f29fa28325d8c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	6880d06f0b0a7f300b0f29fa28325d8c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6880d06f0b0a7f300b0f29fa28325d8c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	6880d06f0b0a7f300b0f29fa28325d8c.exe
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	6880d06f0b0a7f300b0f29fa28325d8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
808	schtasks.exe
3620	schtasks.exe
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2644	6880d06f0b0a7f300b0f29fa28325d8c.exe
2644	6880d06f0b0a7f300b0f29fa28325d8c.exe
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2928	6880d06f0b0a7f300b0f29fa28325d8c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe
Token: SeDebugPrivilege	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 808	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	96
PID 2644 wrote to memory of 808	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	96
PID 2644 wrote to memory of 808	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	96
PID 2644 wrote to memory of 4340	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	98
PID 2644 wrote to memory of 4340	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	98
PID 2644 wrote to memory of 4340	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	98
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2644 wrote to memory of 2928	2644	6880d06f0b0a7f300b0f29fa28325d8c.exe	99
PID 2928 wrote to memory of 3620	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe	101
PID 2928 wrote to memory of 3620	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe	101
PID 2928 wrote to memory of 3620	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe	101
PID 2928 wrote to memory of 3864	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe	102
PID 2928 wrote to memory of 3864	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe	102
PID 2928 wrote to memory of 3864	2928	6880d06f0b0a7f300b0f29fa28325d8c.exe	102

C:\Users\Admin\AppData\Local\Temp\6880d06f0b0a7f300b0f29fa28325d8c.exe
"C:\Users\Admin\AppData\Local\Temp\6880d06f0b0a7f300b0f29fa28325d8c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nmDBtH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E28.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:808
- C:\Users\Admin\AppData\Local\Temp\6880d06f0b0a7f300b0f29fa28325d8c.exe
  "C:\Users\Admin\AppData\Local\Temp\6880d06f0b0a7f300b0f29fa28325d8c.exe"
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\6880d06f0b0a7f300b0f29fa28325d8c.exe
  "C:\Users\Admin\AppData\Local\Temp\6880d06f0b0a7f300b0f29fa28325d8c.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6424.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3620
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6473.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5E28.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5E28.tmp
Size 1KB
SHA256 0f0c7cfd1079125752f4cac60662f02648e3a48f50f0d22b4ac253f533350f57
MD5 2eff7e1109d541add409d83b4ae3ac65
SHA1 c977028fc49f274730d4105afea1c3769ea5c766
SHA512 69881776261547c89dbe70f7c7bc0c2c162c535aaf2e291ed795d5e689d47530f1ab7fce702d871a127c234693e4f5dd224081eca685bf8a9e13bdab905f6593
MD5 SHA1 SHA512

Submit Download

tmp6424.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6424.tmp
Size 1KB
SHA256 daaf2c961008bda27e5682f97e0a410956705f8e0c20ddb11936c0d95da54b1e
MD5 88e36fac4edd883b93b068ea36a17af1
SHA1 21775af8b80a4deef09102c6db589ace19e066ab
SHA512 3b0b18b691f3f39d0d62b957b57194297d064c8a5ea6cc3691d5ea29f872eb523eab17c6b784b1f0e52f0e3350a55240c66eb9d7df844f81c6f17b8f5f4ff976
MD5 SHA1 SHA512

Submit Download

tmp6473.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6473.tmp
Size 1KB
SHA256 38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
MD5 0a24db62cb5b84309c4803346caaa25d
SHA1 67660778f61bb44168c33ed3fe56ed86cf9583e8
SHA512 d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
MD5 SHA1 SHA512

Submit Download

memory/2644-0-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2644-1-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2644-2-0x0000000001320000-0x0000000001330000-memory.dmp

Download

memory/2644-3-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2644-11-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2928-13-0x0000000001200000-0x0000000001210000-memory.dmp

Download

memory/2928-14-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2928-12-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2928-9-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/2928-22-0x0000000001200000-0x0000000001210000-memory.dmp

Download

memory/2928-23-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/2928-24-0x0000000001200000-0x0000000001210000-memory.dmp

Download

memory/2928-25-0x0000000001200000-0x0000000001210000-memory.dmp

Download