nanocore | 3788dc98b496b8eca5bec9fe73397cb6eb6bacadae5637c8e3d3009a98afe203

General

Target

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
Size

688KB
MD5

52a309b059e9c2dccd75d272971e7ea0
SHA1

28bbd88c2bb4670ba0d90c274954c40018dcfc74
SHA256

3788dc98b496b8eca5bec9fe73397cb6eb6bacadae5637c8e3d3009a98afe203
SHA512

ccf237f37d0e54a4cb860a78910cf6f33cfe590a13e945b5c6c1ee91d25bfc023611f39c5ee1e9a7533dbadf717d4bc0990029b2671d12a82122e7ed3e7f28b4
SSDEEP

12288:910pei36RLzmmwtcb2GQ8E5qrln7RJiHw3lm+gKR+shQ2L8BiV6id:96pp36V6HorQ0lmHh9K4s62LyiV6id

Score

10^/10

nanocore evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

staywicked99.ddns.net:63882

127.0.0.1:63882

Mutex

344b2f5a-4a49-455c-8a61-465a5df696b3

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2024-02-23T18:24:33.192101836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
63882
default_group
ash
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
344b2f5a-4a49-455c-8a61-465a5df696b3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
staywicked99.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2784 powershell.exe
3012 powershell.exe

pid	process
2784	powershell.exe
3012	powershell.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	37.235.1.177
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.174
Destination IP	37.235.1.174

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe"	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

description	pid	process	target process
PID 2764 set thread context of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

Drops file in Program Files directory 2 IoCs

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Service\ddpsv.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\DDP Service\ddpsv.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2560 schtasks.exe

pid	process
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exepowershell.exepowershell.exe

pid	process
2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
2476	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
2476	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
2476	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
2784	powershell.exe
3012	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

pid process

2476 52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

pid	process
2476	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2476	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

description	pid	process	target process
PID 2764 wrote to memory of 2784	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 2784	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 2784	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 2784	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 3012	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 3012	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 3012	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 3012	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	powershell.exe
PID 2764 wrote to memory of 2560	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	schtasks.exe
PID 2764 wrote to memory of 2560	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	schtasks.exe
PID 2764 wrote to memory of 2560	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	schtasks.exe
PID 2764 wrote to memory of 2560	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	schtasks.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
PID 2764 wrote to memory of 2476	2764	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe	52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lCTPfR.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lCTPfR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD337.tmp"
2⤵
- Creates scheduled task(s)
PID:2560

C:\Users\Admin\AppData\Local\Temp\52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\52a309b059e9c2dccd75d272971e7ea0_NeikiAnalytics.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD337.tmp
Filesize
1KB

MD5
5d0045670c131798e6b61c991063a800

SHA1
3533d6b5f0ef75eb0a4e94f828feb359318e6398

SHA256
9095c351d24e4a14eb009e1053c4e614d5710af500cd1d347c137ec8aa4c0b37

SHA512
a46e2682b1aa039174de3484e70f8e57280333d33d6c85a12602b19bf7f7a2ad378437baa1f0d74804a0d141095e600516d29968f139f8f7a135973a088d17cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\08EW0TSJR7PN6PM126VE.temp
Filesize
7KB

MD5
a3825738c0606cec62a01daf9065776a

SHA1
28644e75ce6b5f1edaa194f4027ea6371dc6064d

SHA256
7cf99e514f32d2f64626664be8d266da6ec5e857a589c06107f3f267a7e6d57e

SHA512
ad6def3941b66049c15b0a43fdb2e18a753f49db2a9a5f9df0cb1376689bc7f5fd42b34b0e3c2362058560b3c581e47a979c61bbadfcbb14f52b867dba7e0ec7

Download Submit
memory/2476-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2476-29-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2476-37-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/2476-36-0x00000000002E0000-0x00000000002FE000-memory.dmp

Filesize
120KB

Download
memory/2476-35-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/2476-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2476-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2476-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2476-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2476-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2476-31-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2764-2-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-1-0x0000000000340000-0x00000000003F2000-memory.dmp

Filesize
712KB

Download
memory/2764-0-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/2764-3-0x0000000000680000-0x00000000006A2000-memory.dmp

Filesize
136KB

Download
memory/2764-32-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-6-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2764-5-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2764-4-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads