nanocore | e238e933c33b0a35cda7a6e50f9850db8a4860c3b31eb02e93808f1874ced925

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5daa379a96dd79c64c07f2fc26049df.exe
Size 244KB
Sample240305-2rf8pscg58
SHA256 e238e933c33b0a35cda7a6e50f9850db8a4860c3b31eb02e93808f1874ced925
MD5 b5daa379a96dd79c64c07f2fc26049df
SHA1 5abf6bb42ce9a7bfd9a76d49126c846daff8aeeb
SHA512 07a66ab149b1a8800c2fb158dcc1de40b4e93bd7c535bd2a753e9c3800685e364b6bc264fe3571904711c2eabf3c2721b4e800e52e08cbab7ebac1f36bbb296f
SSDEEP 6144:z4MIWkWXx2g9p9PKG8Xkdx7sphjoXQPKx8:z4MI3OxB9pRcX0QhjoXQP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

cyrus-test.ddns.net:5001
127.0.0.1:5001

Mutex

27e59b2d-3f54-46a6-9c97-1bd72e8098ac

Attributes

activate_away_mode
false
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-09-29T13:43:01.245230436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5001
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
27e59b2d-3f54-46a6-9c97-1bd72e8098ac
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
cyrus-test.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	b5daa379a96dd79c64c07f2fc26049df.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\tSSBpQMZcW = "C:\\Users\\Admin\\AppData\\Roaming\\KxYJYebDAB\\eZYWwEJRnB.exe"	b5daa379a96dd79c64c07f2fc26049df.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b5daa379a96dd79c64c07f2fc26049df.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	b5daa379a96dd79c64c07f2fc26049df.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	b5daa379a96dd79c64c07f2fc26049df.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2508	schtasks.exe
2516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1468	b5daa379a96dd79c64c07f2fc26049df.exe
1468	b5daa379a96dd79c64c07f2fc26049df.exe
1468	b5daa379a96dd79c64c07f2fc26049df.exe
1468	b5daa379a96dd79c64c07f2fc26049df.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1468	b5daa379a96dd79c64c07f2fc26049df.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	b5daa379a96dd79c64c07f2fc26049df.exe
Token: SeDebugPrivilege	1468	b5daa379a96dd79c64c07f2fc26049df.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 2868 wrote to memory of 1468	2868	b5daa379a96dd79c64c07f2fc26049df.exe	28
PID 1468 wrote to memory of 2508	1468	b5daa379a96dd79c64c07f2fc26049df.exe	29
PID 1468 wrote to memory of 2508	1468	b5daa379a96dd79c64c07f2fc26049df.exe	29
PID 1468 wrote to memory of 2508	1468	b5daa379a96dd79c64c07f2fc26049df.exe	29
PID 1468 wrote to memory of 2508	1468	b5daa379a96dd79c64c07f2fc26049df.exe	29
PID 1468 wrote to memory of 2516	1468	b5daa379a96dd79c64c07f2fc26049df.exe	31
PID 1468 wrote to memory of 2516	1468	b5daa379a96dd79c64c07f2fc26049df.exe	31
PID 1468 wrote to memory of 2516	1468	b5daa379a96dd79c64c07f2fc26049df.exe	31
PID 1468 wrote to memory of 2516	1468	b5daa379a96dd79c64c07f2fc26049df.exe	31

C:\Users\Admin\AppData\Local\Temp\b5daa379a96dd79c64c07f2fc26049df.exe
"C:\Users\Admin\AppData\Local\Temp\b5daa379a96dd79c64c07f2fc26049df.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\b5daa379a96dd79c64c07f2fc26049df.exe
  "C:\Users\Admin\AppData\Local\Temp\b5daa379a96dd79c64c07f2fc26049df.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6DE0.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2508
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8A56.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp6DE0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6DE0.tmp
Size 1KB
SHA256 c374d6d5d0e67f159c77d477a9c05d852c999e3aaded0399338f588eecb9dc8e
MD5 a5ce40afd2de57689b749f2981065561
SHA1 eccf8db346998c87fe494e6a63c657e4c98b20d3
SHA512 780ccec682fbd76d090ef08be96022800df54b868142eeca7c55e2034658ba8981903533c0ab71dc625d12a2863ee73e8c986f45e41493394129f68b749d3c47
MD5 SHA1 SHA512

Submit Download

tmp8A56.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8A56.tmp
Size 1KB
SHA256 062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
MD5 4b7ef560289c0f62d0baf6f14f48a57a
SHA1 8331acb90dde588aa3196919f6e847f398fd06d1
SHA512 ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8
MD5 SHA1 SHA512

Submit Download

memory/1468-8-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-18-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-6-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-34-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Download

memory/1468-10-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1468-14-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-16-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-33-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Download

memory/1468-4-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1468-20-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Download

memory/1468-21-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Download

memory/1468-32-0x0000000000800000-0x000000000080A000-memory.dmp

Download

memory/1468-31-0x0000000000610000-0x000000000062E000-memory.dmp

Download

memory/1468-29-0x00000000002E0000-0x00000000002EA000-memory.dmp

Download

memory/1468-30-0x00000000002F0000-0x00000000002FC000-memory.dmp

Download

memory/2868-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Download

memory/2868-3-0x0000000000360000-0x000000000036A000-memory.dmp

Download

memory/2868-19-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Download

memory/2868-0-0x0000000000290000-0x00000000002D2000-memory.dmp

Download