nanocore | 396af88f6a9eeb0614ce8aa23bbb42b24ce01ab5abb18b87d49a24dc16db0a7a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d75e198aabc8f95796bd8a8cd15a5313.exe
Size 785KB
Sample240319-3ncxjsbd8s
SHA256 396af88f6a9eeb0614ce8aa23bbb42b24ce01ab5abb18b87d49a24dc16db0a7a
MD5 d75e198aabc8f95796bd8a8cd15a5313
SHA1 52eda5c4c002aa5b9672275b276786e2a94e5423
SHA512 c7ee5e86c5f6257d654f5d9f3a9aaf69494e390003208aa9e27e8e4175b7e86c7fb453de5ea6965236a4568de26e6a576144410c1d109bc845b2c8ca5dc82590
SSDEEP 12288:5/2RuIocirEJUitAi6uwgP3VDbVcY6otf6Cjp5QuYhMKCBwurT1cegQXaw1yJCX:5/2RIzr7BycY6SSCj3Yh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

godisgood1.hopto.org:7712

Mutex

9ed8d108-2eb1-4e23-9679-783796e4baff

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-04-23T17:16:53.813634136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7712
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9ed8d108-2eb1-4e23-9679-783796e4baff
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
godisgood1.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Service = "C:\\Program Files (x86)\\IMAP Service\\imapsv.exe"	d75e198aabc8f95796bd8a8cd15a5313.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d75e198aabc8f95796bd8a8cd15a5313.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3516 set thread context of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\IMAP Service\imapsv.exe	d75e198aabc8f95796bd8a8cd15a5313.exe
File opened for modification	C:\Program Files (x86)\IMAP Service\imapsv.exe	d75e198aabc8f95796bd8a8cd15a5313.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2188	schtasks.exe
2288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4724	d75e198aabc8f95796bd8a8cd15a5313.exe
4724	d75e198aabc8f95796bd8a8cd15a5313.exe
4724	d75e198aabc8f95796bd8a8cd15a5313.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4724	d75e198aabc8f95796bd8a8cd15a5313.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	d75e198aabc8f95796bd8a8cd15a5313.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 3516 wrote to memory of 4724	3516	d75e198aabc8f95796bd8a8cd15a5313.exe	103
PID 4724 wrote to memory of 2188	4724	d75e198aabc8f95796bd8a8cd15a5313.exe	104
PID 4724 wrote to memory of 2188	4724	d75e198aabc8f95796bd8a8cd15a5313.exe	104
PID 4724 wrote to memory of 2188	4724	d75e198aabc8f95796bd8a8cd15a5313.exe	104
PID 4724 wrote to memory of 2288	4724	d75e198aabc8f95796bd8a8cd15a5313.exe	106
PID 4724 wrote to memory of 2288	4724	d75e198aabc8f95796bd8a8cd15a5313.exe	106
PID 4724 wrote to memory of 2288	4724	d75e198aabc8f95796bd8a8cd15a5313.exe	106

C:\Users\Admin\AppData\Local\Temp\d75e198aabc8f95796bd8a8cd15a5313.exe
"C:\Users\Admin\AppData\Local\Temp\d75e198aabc8f95796bd8a8cd15a5313.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\d75e198aabc8f95796bd8a8cd15a5313.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "IMAP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB7E6.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2188
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "IMAP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB816.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB7E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB7E6.tmp
Size 1KB
SHA256 44427ae768ec2152733f93eb86434ea11732ffb9ff7576a8d90c733407eedbc7
MD5 8d8c286d4fcf695f2e06f57da085a960
SHA1 be80e7164e6b8149ffe871bdcdf724496bba0074
SHA512 7f0f3ceab5516d45bb89887c5e40bba38c87f98289c5232efe2e1e0f29be988a00ac3adfee056f5d59658ccceba3b059d649053e9c8a0a348b62a6e4260804be
MD5 SHA1 SHA512

Submit Download

tmpB816.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB816.tmp
Size 1KB
SHA256 b3689f65cd1048f673cda43b0f93ffddb45bc67da94a62335b7c75ba0f0b2852
MD5 266ebd097e1267e63a5abfc1dededae8
SHA1 b619bdaa65cbb17c86da3744e566e6a66c7057b4
SHA512 4db2526f588777bfaf8b7d7799d19e5e384f0ed1fff1905196277383378a98e73b7952d4bccf22cd92c53b5d7f9c9057f896a773a58b1908fe4a41aadae047bd
MD5 SHA1 SHA512

Submit Download

memory/3516-0-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3516-1-0x0000000001730000-0x0000000001740000-memory.dmp

Download

memory/3516-2-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3516-3-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/3516-4-0x0000000001730000-0x0000000001740000-memory.dmp

Download

memory/3516-8-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/4724-9-0x00000000015B0000-0x00000000015C0000-memory.dmp

Download

memory/4724-10-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/4724-7-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/4724-5-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4724-18-0x00000000015B0000-0x00000000015C0000-memory.dmp

Download

memory/4724-19-0x0000000075540000-0x0000000075AF1000-memory.dmp

Download

memory/4724-20-0x00000000015B0000-0x00000000015C0000-memory.dmp

Download

memory/4724-21-0x00000000015B0000-0x00000000015C0000-memory.dmp

Download