nanocore | a5ac0dfa706e54b84ea190b833844df140c4d656539d75afddc32d3169869ea3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49FA1594271555F95AA333030802DEA0.exe
Size 210KB
Sample240207-1z3agabfa2
SHA256 a5ac0dfa706e54b84ea190b833844df140c4d656539d75afddc32d3169869ea3
MD5 49fa1594271555f95aa333030802dea0
SHA1 2ab1acd64df0a910fbb42248d3586ba96adebdeb
SHA512 7efc0fc5e9d26833b0ad6dcddb9b509a7e0ebde964287cb676626146afebe69b4e919ccb7356bc1a9a89662675b53880f2c6ea748a229c78b958cb061a33a59c
SSDEEP 6144:ALV6Bta6dtJmakIM5S/C++adghMiGFajpr:ALV6BtpmkJ/CsdghbsQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore quasar a nommer evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

A nommer

victacking.ddns.net:4789

Mutex

2871a328-24b9-4998-9cb0-e3652624a67a

Attributes

encryption_key
77E1CE64C90713D69376A654F4C56C1E0262C545
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsSystemTask
subdirectory
SubDir

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00050000000217fa-23.dat	family_quasar
behavioral2/memory/228-30-0x0000000000AA0000-0x0000000000DC4000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	49FA1594271555F95AA333030802DEA0.exe

Executes dropped EXE 3 IoCs

pid	Process
228	Quasar.exe
2552	Client.exe
2576	Quasar.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsvc.exe"	49FA1594271555F95AA333030802DEA0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	49FA1594271555F95AA333030802DEA0.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DHCP Service\dhcpsvc.exe	49FA1594271555F95AA333030802DEA0.exe
File opened for modification	C:\Program Files (x86)\DHCP Service\dhcpsvc.exe	49FA1594271555F95AA333030802DEA0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1212	schtasks.exe
4796	schtasks.exe
1340	schtasks.exe
3288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
448	49FA1594271555F95AA333030802DEA0.exe
448	49FA1594271555F95AA333030802DEA0.exe
448	49FA1594271555F95AA333030802DEA0.exe
448	49FA1594271555F95AA333030802DEA0.exe
448	49FA1594271555F95AA333030802DEA0.exe
448	49FA1594271555F95AA333030802DEA0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
448	49FA1594271555F95AA333030802DEA0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	49FA1594271555F95AA333030802DEA0.exe
Token: SeDebugPrivilege	228	Quasar.exe
Token: SeDebugPrivilege	2552	Client.exe
Token: SeDebugPrivilege	2576	Quasar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	Client.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1212	448	49FA1594271555F95AA333030802DEA0.exe	83
PID 448 wrote to memory of 1212	448	49FA1594271555F95AA333030802DEA0.exe	83
PID 448 wrote to memory of 1212	448	49FA1594271555F95AA333030802DEA0.exe	83
PID 448 wrote to memory of 4796	448	49FA1594271555F95AA333030802DEA0.exe	85
PID 448 wrote to memory of 4796	448	49FA1594271555F95AA333030802DEA0.exe	85
PID 448 wrote to memory of 4796	448	49FA1594271555F95AA333030802DEA0.exe	85
PID 448 wrote to memory of 228	448	49FA1594271555F95AA333030802DEA0.exe	96
PID 448 wrote to memory of 228	448	49FA1594271555F95AA333030802DEA0.exe	96
PID 228 wrote to memory of 1340	228	Quasar.exe	97
PID 228 wrote to memory of 1340	228	Quasar.exe	97
PID 228 wrote to memory of 2552	228	Quasar.exe	99
PID 228 wrote to memory of 2552	228	Quasar.exe	99
PID 2552 wrote to memory of 3288	2552	Client.exe	100
PID 2552 wrote to memory of 3288	2552	Client.exe	100
PID 448 wrote to memory of 2576	448	49FA1594271555F95AA333030802DEA0.exe	102
PID 448 wrote to memory of 2576	448	49FA1594271555F95AA333030802DEA0.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\49FA1594271555F95AA333030802DEA0.exe
"C:\Users\Admin\AppData\Local\Temp\49FA1594271555F95AA333030802DEA0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1212
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp11FD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4796
- C:\Users\Admin\Desktop\Quasar.exe
  "C:\Users\Admin\Desktop\Quasar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WindowsSystemTask" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1340
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsSystemTask" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3288
- C:\Users\Admin\Desktop\Quasar.exe
  "C:\Users\Admin\Desktop\Quasar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Quasar.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

tmp1037.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp
Size 1KB
SHA256 d4ce6a8e22c6a943270e38d03d5dd09272a4a627bb5680c27105f3d5af556b83
MD5 2b519663b28c917f513432a55026dca7
SHA1 eeec0c83cc2f89e2a6c31ecdd752491c46ee3acb
SHA512 aa9713ab256c6102da5a1496195d1fd8584c8f30f6312c1c07e362af1433cd5f8f2854115e373540343aee67bb39446c7912e059ac14cd7bdc404fc5d513d510
MD5 SHA1 SHA512

Submit Download

tmp11FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp11FD.tmp
Size 1KB
SHA256 39b16b3a00b6b43c6820357127228c0768a577153014ce7b0ea3c585244dc08b
MD5 7f4b37265a0a4b0fea67999d11d911e8
SHA1 1b8e13e6a27c3768c30cf713b79eaa8a757e1349
SHA512 ef97ccfb663555aedc7fdc4b3ac4cd6536c80a778b4ec3bc6124a09544733988de1dac1e6a3714b0d6e8713e3523e0732d5dfcf674f2c5e1f3eadacb0c8e5e03
MD5 SHA1 SHA512

Submit Download

Quasar.exe

Path C:\Users\Admin\Desktop\Quasar.exe
Size 3.1MB
SHA256 8e3441e2aea93a3d3d5966e669b701c3c046b083d9829ac0905b46fea13bf145
MD5 7370111b771c7f3059ee2d06b22f490f
SHA1 1fad6426efc8a7497e5cebc418129f20bf962e12
SHA512 ff6d3f131d08a94756a0c95f69a5dfa330f2145aa1b8447307edabf3b5f0a248e7839469c472d5e5a6ae723007578464a0bc8fb8bc6cfd308b14ff31cafaaf86
SSDEEP 49152:bvWI22SsaNYfdPBldt698dBcjHwtQaEf/xk/M54oGdAQTHHB72eh2NT:bv722SsaNYfdPBldt6+dBcjHwtQFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-44-0x00007FFE09F20000-0x00007FFE0A9E1000-memory.dmp

Download

memory/228-32-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Download

memory/228-31-0x00007FFE09F20000-0x00007FFE0A9E1000-memory.dmp

Download

memory/228-30-0x0000000000AA0000-0x0000000000DC4000-memory.dmp

Download

memory/448-14-0x0000000074CF0000-0x00000000752A1000-memory.dmp

Download

memory/448-17-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/448-16-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/448-15-0x0000000074CF0000-0x00000000752A1000-memory.dmp

Download

memory/448-0-0x0000000074CF0000-0x00000000752A1000-memory.dmp

Download

memory/448-10-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/448-1-0x0000000074CF0000-0x00000000752A1000-memory.dmp

Download

memory/448-2-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/2552-41-0x000000001C290000-0x000000001C342000-memory.dmp

Download

memory/2552-40-0x0000000002EF0000-0x0000000002F40000-memory.dmp

Download

memory/2552-42-0x0000000002F60000-0x0000000002F72000-memory.dmp

Download

memory/2552-43-0x000000001C1D0000-0x000000001C20C000-memory.dmp

Download

memory/2552-39-0x000000001BAD0000-0x000000001BAE0000-memory.dmp

Download

memory/2552-45-0x00007FFE09F20000-0x00007FFE0A9E1000-memory.dmp

Download

memory/2552-46-0x000000001BAD0000-0x000000001BAE0000-memory.dmp

Download

memory/2552-38-0x00007FFE09F20000-0x00007FFE0A9E1000-memory.dmp

Download

memory/2576-49-0x00007FFE09F20000-0x00007FFE0A9E1000-memory.dmp

Download

memory/2576-50-0x000000001B570000-0x000000001B580000-memory.dmp

Download

memory/2576-51-0x00007FFE09F20000-0x00007FFE0A9E1000-memory.dmp

Download