nanocore | 47192dd309d6c48b89c878d180d52450b53292c27d341f2a71e76cfe538088f6

General

Target

e11a82bcb6a36defb53bcc5bbf6633db.exe
Size

1.0MB
MD5

e11a82bcb6a36defb53bcc5bbf6633db
SHA1

8538ddac72c9dc1beb2937874d4e0143e1829800
SHA256

47192dd309d6c48b89c878d180d52450b53292c27d341f2a71e76cfe538088f6
SHA512

d849ab79c5a73a242edbd78c250ab409e89f0c10908ed2955967df5b671b13988a91b9794191457dcacfab5e2538db63e421061e1be09e473f44194032405d9e
SSDEEP

12288:DLfDc9F3nC0Py3gAhYe/vNNoEY4xpZ6TYK/fe7ywbZIsseKJi2HHiS8HY:vx/vNndxpZ3K/fedbZWJiwCScY

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

godnogoshameus.ddns.net:1106

Mutex

1e90f872-1fd0-4a52-b478-e5631112c990

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-04-23T17:07:07.231749836Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1106
default_group
GRACE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1e90f872-1fd0-4a52-b478-e5631112c990
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
godnogoshameus.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Suspicious use of SetThreadContext 1 IoCs

Processes:

e11a82bcb6a36defb53bcc5bbf6633db.exe

description pid process target process

PID 2952 set thread context of 2668 2952 e11a82bcb6a36defb53bcc5bbf6633db.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2748 schtasks.exe
2512 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e11a82bcb6a36defb53bcc5bbf6633db.exeMSBuild.exe

pid process

2952 e11a82bcb6a36defb53bcc5bbf6633db.exe
2668 MSBuild.exe
2668 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

2668 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e11a82bcb6a36defb53bcc5bbf6633db.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 2952 e11a82bcb6a36defb53bcc5bbf6633db.exe
Token: SeDebugPrivilege 2668 MSBuild.exe

description	pid	process	target process
PID 2952 set thread context of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe

pid	process
2748	schtasks.exe
2512	schtasks.exe

pid	process
2952	e11a82bcb6a36defb53bcc5bbf6633db.exe
2668	MSBuild.exe
2668	MSBuild.exe

pid	process
2668	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe
Token: SeDebugPrivilege	2668	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

e11a82bcb6a36defb53bcc5bbf6633db.exeMSBuild.exe

description	pid	process	target process
PID 2952 wrote to memory of 2748	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	schtasks.exe
PID 2952 wrote to memory of 2748	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	schtasks.exe
PID 2952 wrote to memory of 2748	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	schtasks.exe
PID 2952 wrote to memory of 2748	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	schtasks.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2952 wrote to memory of 2668	2952	e11a82bcb6a36defb53bcc5bbf6633db.exe	MSBuild.exe
PID 2668 wrote to memory of 2512	2668	MSBuild.exe	schtasks.exe
PID 2668 wrote to memory of 2512	2668	MSBuild.exe	schtasks.exe
PID 2668 wrote to memory of 2512	2668	MSBuild.exe	schtasks.exe
PID 2668 wrote to memory of 2512	2668	MSBuild.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e11a82bcb6a36defb53bcc5bbf6633db.exe
"C:\Users\Admin\AppData\Local\Temp\e11a82bcb6a36defb53bcc5bbf6633db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uiDRzVd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB4DE.tmp"
2⤵
- Creates scheduled task(s)
PID:2748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB75D.tmp"
3⤵
- Creates scheduled task(s)
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB4DE.tmp
Filesize
1KB

MD5
574c8da369dd1f26aa43c812e2170bc9

SHA1
f8ed05fc3620bd9ab4fa6572c75d8159294b1709

SHA256
2a3a3f71e6252e59d3660e1902830538a58d5c7c16ffabc49925067d7e7de1aa

SHA512
9a5b54d40cb95902477995050ddb8d5ff7c92e6035cbca08ddf9778247032eeac2c89649482554ee2c306533ccceb3df50a31c84a388ee17599a0bddcfb4df39

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB75D.tmp
Filesize
1KB

MD5
3e2b26ed8b75ae83a269595180e84ef6

SHA1
d30a0335fcce406bca8ba5764288235e6192f608

SHA256
108be30aeb8eb31c185a39a6726f26dacbc4e4124951c61a29ade4b7038c71ea

SHA512
b6981c68fcb886cc8379a068b96931b9d4f5cc5aa9bdc467e36c4168fe6c5273a2a84d8850b12c11703ec03ac6b1f1950d1e669efcb59fc2402ce4bba9dc03d3

Download Submit
memory/2668-26-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2668-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2668-36-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-20-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-34-0x0000000000490000-0x00000000004AE000-memory.dmp

Filesize
120KB

Download
memory/2668-33-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/2668-28-0x00000000044D0000-0x0000000004510000-memory.dmp

Filesize
256KB

Download
memory/2668-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2668-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2668-37-0x00000000044D0000-0x0000000004510000-memory.dmp

Filesize
256KB

Download
memory/2668-35-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2668-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2668-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2668-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2952-2-0x0000000000450000-0x0000000000490000-memory.dmp

Filesize
256KB

Download
memory/2952-1-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2952-27-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2952-0-0x0000000001210000-0x000000000131A000-memory.dmp

Filesize
1.0MB

Download
memory/2952-3-0x0000000000430000-0x0000000000448000-memory.dmp

Filesize
96KB

Download
memory/2952-7-0x0000000000BA0000-0x0000000000BD8000-memory.dmp

Filesize
224KB

Download
memory/2952-6-0x0000000008080000-0x0000000008128000-memory.dmp

Filesize
672KB

Download
memory/2952-5-0x0000000000450000-0x0000000000490000-memory.dmp

Filesize
256KB

Download
memory/2952-4-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads