nanocore | 67617f95de4c19d97e4de6934d2b29e02625853fe80a205ff4086c8bb32cd4ab

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
864e2a02a8da7f5829616b793608b6a5.exe
Size 1.4MB
Sample240201-jd9c8ageel
SHA256 67617f95de4c19d97e4de6934d2b29e02625853fe80a205ff4086c8bb32cd4ab
MD5 864e2a02a8da7f5829616b793608b6a5
SHA1 619a1d84a874f2698f44345d49cd02a205cac6a3
SHA512 847353349017e49e763fb9cab36e61045780500e5ccfaa03a438eb566cde28ab312068947839531aaf77e7b0edbda4d6acdcbf4c45f7b56c6b580b9e504acb47
SSDEEP 24576:0YbZ4tp4AmnemleGlp7BQrH93T2fXKvOc:VbqppxKlp9Md3T2/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

fellasbam.ddns.net:1608

Mutex

5e85a270-fa64-4260-8631-d4ec385a3021

Attributes

activate_away_mode
true
backup_connection_host
fellasbam.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-05-21T08:44:23.523905136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1608
default_group
NEW UPDATE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
5e85a270-fa64-4260-8631-d4ec385a3021
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
fellasbam.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	864e2a02a8da7f5829616b793608b6a5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3412 set thread context of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UDP Subsystem\udpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\UDP Subsystem\udpss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4060	schtasks.exe
240	schtasks.exe
5012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
952	RegSvcs.exe
952	RegSvcs.exe
952	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4060	3412	864e2a02a8da7f5829616b793608b6a5.exe	92
PID 3412 wrote to memory of 4060	3412	864e2a02a8da7f5829616b793608b6a5.exe	92
PID 3412 wrote to memory of 4060	3412	864e2a02a8da7f5829616b793608b6a5.exe	92
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 3412 wrote to memory of 952	3412	864e2a02a8da7f5829616b793608b6a5.exe	94
PID 952 wrote to memory of 240	952	RegSvcs.exe	96
PID 952 wrote to memory of 240	952	RegSvcs.exe	96
PID 952 wrote to memory of 240	952	RegSvcs.exe	96
PID 952 wrote to memory of 5012	952	RegSvcs.exe	97
PID 952 wrote to memory of 5012	952	RegSvcs.exe	97
PID 952 wrote to memory of 5012	952	RegSvcs.exe	97

C:\Users\Admin\AppData\Local\Temp\864e2a02a8da7f5829616b793608b6a5.exe
"C:\Users\Admin\AppData\Local\Temp\864e2a02a8da7f5829616b793608b6a5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nYPSbf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp24F8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4060
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2AF3.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3034.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp24F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp24F8.tmp
Size 1KB
SHA256 eb610aeac93b9bb12db9bf5315aae4b60651a370cf1ee1a57950fc5a621c4180
MD5 f67603d36df83d619600f24b18b92798
SHA1 396d5c0051148a290df92eae2797698e943f9bcb
SHA512 ba6a99e6799dce1ee6afcf11bc3f67f7680103e205e4eeff749b068d2011ce3755cf4c151d7414e1e4cb4a6bfa55e1521aa40d4ab702c4c5ebb8908c2a227077
MD5 SHA1 SHA512

Submit Download

tmp2AF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp2AF3.tmp
Size 1KB
SHA256 c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
MD5 40b11ef601fb28f9b2e69d36857bf2ec
SHA1 b6454020ad2ceed193f4792b77001d0bd741b370
SHA512 e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
MD5 SHA1 SHA512

Submit Download

tmp3034.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3034.tmp
Size 1KB
SHA256 24fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b
MD5 c4aecdef99eba873119e79616df3f4b0
SHA1 b1b3af52655fb633eed909dfed05b64fbbfac37c
SHA512 e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4
MD5 SHA1 SHA512

Submit Download

memory/952-27-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/952-26-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/952-25-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/952-24-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/952-10-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/952-12-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/952-23-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/952-13-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/952-15-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/3412-4-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/3412-14-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/3412-0-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/3412-3-0x0000000075190000-0x0000000075741000-memory.dmp

Download

memory/3412-2-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/3412-1-0x0000000075190000-0x0000000075741000-memory.dmp

Download