nanocore | 4151897619823917cf3420046de0a8d3c0da19995acbcb134cc784250945d53a

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3a6b2942804437bb23319f5df1e56c3.exe
Size 928KB
Sample240318-qxfzcaaa38
SHA256 4151897619823917cf3420046de0a8d3c0da19995acbcb134cc784250945d53a
MD5 d3a6b2942804437bb23319f5df1e56c3
SHA1 27e4cff6374c24928b365a80aef85697025b2af3
SHA512 a0bd4f47c5ab4a1f5e7c637430593b5585ce691120ba84171c22e2bbd5a113546f81242ba5a0fb200fd90a33d774ab4960be66f79ee2c26e8dd065ab16707f16
SSDEEP 24576:X0I9AIw98hljilLI1hBd/+xF8oEHA8sBMxWrj8MNj:Ee+6lmi1hD+3+RdxYjlh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore snakekeylogger evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
send.one.com
Port
587
Username
[email protected]
Password
btRhqDDqbQXOw2SC
Email to
[email protected]

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023395-34.dat	family_snakekeylogger
behavioral2/memory/4644-43-0x0000000000310000-0x0000000000334000-memory.dmp	family_snakekeylogger
behavioral2/memory/1688-46-0x0000000000E30000-0x0000000000E40000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	d3a6b2942804437bb23319f5df1e56c3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	d3a6b2942804437bb23319f5df1e56c3.exe

Executes dropped EXE 2 IoCs

pid	Process
1688	ikmerro nano.exe
4644	snake logger.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Host = "C:\\Program Files (x86)\\UPNP Host\\upnphost.exe"	ikmerro nano.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ikmerro nano.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
145	checkip.dyndns.org
150	freegeoip.app
151	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UPNP Host\upnphost.exe	ikmerro nano.exe
File opened for modification	C:\Program Files (x86)\UPNP Host\upnphost.exe	ikmerro nano.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4752	schtasks.exe
2580	schtasks.exe
5004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4884	d3a6b2942804437bb23319f5df1e56c3.exe
4884	d3a6b2942804437bb23319f5df1e56c3.exe
4884	d3a6b2942804437bb23319f5df1e56c3.exe
4884	d3a6b2942804437bb23319f5df1e56c3.exe
4644	snake logger.exe
4644	snake logger.exe
1688	ikmerro nano.exe
1688	ikmerro nano.exe
1688	ikmerro nano.exe
1688	ikmerro nano.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1688	ikmerro nano.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	d3a6b2942804437bb23319f5df1e56c3.exe
Token: SeDebugPrivilege	4644	snake logger.exe
Token: SeDebugPrivilege	1688	ikmerro nano.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4752	4884	d3a6b2942804437bb23319f5df1e56c3.exe	107
PID 4884 wrote to memory of 4752	4884	d3a6b2942804437bb23319f5df1e56c3.exe	107
PID 4884 wrote to memory of 4752	4884	d3a6b2942804437bb23319f5df1e56c3.exe	107
PID 4884 wrote to memory of 1492	4884	d3a6b2942804437bb23319f5df1e56c3.exe	109
PID 4884 wrote to memory of 1492	4884	d3a6b2942804437bb23319f5df1e56c3.exe	109
PID 4884 wrote to memory of 1492	4884	d3a6b2942804437bb23319f5df1e56c3.exe	109
PID 4884 wrote to memory of 4868	4884	d3a6b2942804437bb23319f5df1e56c3.exe	110
PID 4884 wrote to memory of 4868	4884	d3a6b2942804437bb23319f5df1e56c3.exe	110
PID 4884 wrote to memory of 4868	4884	d3a6b2942804437bb23319f5df1e56c3.exe	110
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4884 wrote to memory of 4356	4884	d3a6b2942804437bb23319f5df1e56c3.exe	111
PID 4356 wrote to memory of 1688	4356	d3a6b2942804437bb23319f5df1e56c3.exe	112
PID 4356 wrote to memory of 1688	4356	d3a6b2942804437bb23319f5df1e56c3.exe	112
PID 4356 wrote to memory of 1688	4356	d3a6b2942804437bb23319f5df1e56c3.exe	112
PID 4356 wrote to memory of 4644	4356	d3a6b2942804437bb23319f5df1e56c3.exe	113
PID 4356 wrote to memory of 4644	4356	d3a6b2942804437bb23319f5df1e56c3.exe	113
PID 1688 wrote to memory of 2580	1688	ikmerro nano.exe	114
PID 1688 wrote to memory of 2580	1688	ikmerro nano.exe	114
PID 1688 wrote to memory of 2580	1688	ikmerro nano.exe	114
PID 1688 wrote to memory of 5004	1688	ikmerro nano.exe	116
PID 1688 wrote to memory of 5004	1688	ikmerro nano.exe	116
PID 1688 wrote to memory of 5004	1688	ikmerro nano.exe	116

C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe
"C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fiPVDuIushYm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4752
- C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe
  "C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe"
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe
  "C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe"
  2⤵
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe
  "C:\Users\Admin\AppData\Local\Temp\d3a6b2942804437bb23319f5df1e56c3.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\ikmerro nano.exe
    "C:\Users\Admin\AppData\Local\Temp\ikmerro nano.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UPNP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2580
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UPNP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3BBD.tmp"
      4⤵
      Creates scheduled task(s)
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\snake logger.exe
    "C:\Users\Admin\AppData\Local\Temp\snake logger.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d3a6b2942804437bb23319f5df1e56c3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d3a6b2942804437bb23319f5df1e56c3.exe.log
Size 1KB
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
MD5 SHA1 SHA512

Submit Download

ikmerro nano.exe

Path C:\Users\Admin\AppData\Local\Temp\ikmerro nano.exe
Size 217KB
SHA256 0195b5c6f14b4d3c3b9654187133f96e8c498a0831d2a0961b6885a8d4932e47
MD5 ec962e97ec8150569cda2415c5d07628
SHA1 1043e3b22ceb0f35d695f2096af0c2a5b25a1000
SHA512 3a98f28160429cbc23efcaf59f8f8e60ada03a80b7dbb917a44d97b8e9442ea275c4fda8dc25655aab7c73e264459c78ec56fdf7cf49df163a43be553d6b0179
SSDEEP 6144:MLV6Bta6dtJmakIM5jRytPfyPxvc3sNrP:MLV6Btpmk4APKLNrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

snake logger.exe

Path C:\Users\Admin\AppData\Local\Temp\snake logger.exe
Size 121KB
SHA256 bc903d20250251ec239811b9007c5221f5c267a1e1a9e9e8dd1eb05e062d5e06
MD5 e0c153e19ccb6366a79cf3571a191561
SHA1 dfee299bd88926e7b9f07c4ea8ae31d2cba69367
SHA512 b8e88d57e87a7b4b75206477de934076f222fd757325ee80aaadebbc8a58f9b93898e1b9a9c31f8a0ff833c7358fcb0b0bd57e60c7ac55ffd9f6822238fbaa60
SSDEEP 3072:umOANz/For2k1iD2V8pRVdhHkRcubScAwB+FZ:0T1i6V8vVrvubqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp290F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp
Size 1KB
SHA256 5fc4d1b75f3697ae5e05dd7ef30c03c03c421a93a4033be25ab14477a88af50b
MD5 7a4d9d32966890a9a4047e62c5c220ec
SHA1 f8b64ef51627f21bd1e5710c96e3f78e2182ffa2
SHA512 d16667b8fddc5bffdabedb5cb9f75174eb2d2d9674549f5062787bfea3e18e7dc7b6e411410f5f496cf69015b002c515099b6c3474b2e521ea7e94217ae50838
MD5 SHA1 SHA512

Submit Download

tmp3A55.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp
Size 1KB
SHA256 f63da8e36f2ec1c72796d9a7fc847fd0664eb70309220f235cade3298067ce4f
MD5 de7b292240c4c9c91f0162c3cc05f7a5
SHA1 6d0150832d202896ad611cf840d8e794355ba276
SHA512 a5df353a2ae111c3b847f26b7de7dab9b3ac323de55679e91f9d6f17d0d551ba783bef3c5603ae436aa5e5708fc9e6a97036927fc0c4239b51486e79e51f996e
MD5 SHA1 SHA512

Submit Download

tmp3BBD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3BBD.tmp
Size 1KB
SHA256 393c769644b1c640753a6bab46cd6c8cbaf984d116d6f7dd1a071d5f2afa42f9
MD5 88bf0bc1e20b64333f39f1cf2085a729
SHA1 6d8eeef3d8f118ded3f2f1dc55ffaa71ee5d7ad8
SHA512 74dfacf7443b7b08da09d40bca1b2a99e7dc44d9d5289f86e1b718f3268b1b11e85c04eb8dd0a5e95788726f09678051a27902d509f015a5ff6609c7d8ec9aba
MD5 SHA1 SHA512

Submit Download

memory/1688-58-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/1688-49-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/1688-47-0x0000000070320000-0x00000000708D1000-memory.dmp

Download

memory/1688-46-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/1688-44-0x0000000070320000-0x00000000708D1000-memory.dmp

Download

memory/1688-57-0x0000000070320000-0x00000000708D1000-memory.dmp

Download

memory/1688-59-0x0000000070320000-0x00000000708D1000-memory.dmp

Download

memory/1688-60-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/4356-22-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/4356-19-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4356-17-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4356-42-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4644-43-0x0000000000310000-0x0000000000334000-memory.dmp

Download

memory/4644-56-0x00007FFBAA9F0000-0x00007FFBAB4B1000-memory.dmp

Download

memory/4644-45-0x00007FFBAA9F0000-0x00007FFBAB4B1000-memory.dmp

Download

memory/4884-11-0x00000000089F0000-0x0000000008A6C000-memory.dmp

Download

memory/4884-10-0x00000000063D0000-0x000000000649E000-memory.dmp

Download

memory/4884-20-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4884-9-0x0000000004C10000-0x0000000004C20000-memory.dmp

Download

memory/4884-8-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4884-7-0x0000000004E80000-0x0000000004E9A000-memory.dmp

Download

memory/4884-6-0x0000000004B40000-0x0000000004B4A000-memory.dmp

Download

memory/4884-5-0x0000000004C10000-0x0000000004C20000-memory.dmp

Download

memory/4884-0-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4884-4-0x0000000004C40000-0x0000000004CDC000-memory.dmp

Download

memory/4884-3-0x0000000004A90000-0x0000000004B22000-memory.dmp

Download

memory/4884-2-0x0000000005150000-0x00000000056F4000-memory.dmp

Download

memory/4884-1-0x0000000000110000-0x00000000001FC000-memory.dmp

Download