nanocore | fd0ac4a7a49fa7aef5fe4bd431bd1c170243116355b94adfa01353af1cad6a00

General

Target

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe
Size

1.0MB
MD5

56eacbaec7c2239feeacdadf3fae0786
SHA1

4dc23ff9c577ae0218a8e87818400b952bc45170
SHA256

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9
SHA512

ab109cdb85febecb7a8307d9b3aa12219b6717fbcc1e610619e6947ba38a2e465b3bd472c53c1a11f6292ec82e8b28088a977fb2e11ed30b10768a309d3fec8f
SSDEEP

24576:OAHnh+eWsN3skA4RV1Hom2KXMmHasJkhRx2hjnQE6nHTo5:5h+ZkldoPK8Yasmh/yjnQEgHK

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

zaragoza.ddns.net:6318

Mutex

23bc2405-d53d-4763-a563-8ae141477f39

Attributes

activate_away_mode
true
backup_connection_host
zaragoza.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-03-05T18:44:12.253319636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6318
default_group
BULKMONEY
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
23bc2405-d53d-4763-a563-8ae141477f39
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
zaragoza.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

description	pid	process	target process
PID 2600 set thread context of 5100	2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisvc.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3620 2600 WerFault.exe 8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2868 schtasks.exe
2576 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

RegSvcs.exe

pid process

5100 RegSvcs.exe
5100 RegSvcs.exe
5100 RegSvcs.exe
5100 RegSvcs.exe
5100 RegSvcs.exe
5100 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

5100 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

pid process

2600 8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 5100 RegSvcs.exe

pid	pid_target	process	target process
3620	2600	WerFault.exe	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

pid	process
2868	schtasks.exe
2576	schtasks.exe

pid	process
5100	RegSvcs.exe
5100	RegSvcs.exe
5100	RegSvcs.exe
5100	RegSvcs.exe
5100	RegSvcs.exe
5100	RegSvcs.exe

pid	process
5100	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	5100	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

pid	process
2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe
2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

pid	process
2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe
2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exeRegSvcs.exe

description	pid	process	target process
PID 2600 wrote to memory of 5100	2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe	RegSvcs.exe
PID 2600 wrote to memory of 5100	2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe	RegSvcs.exe
PID 2600 wrote to memory of 5100	2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe	RegSvcs.exe
PID 2600 wrote to memory of 5100	2600	8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe	RegSvcs.exe
PID 5100 wrote to memory of 2868	5100	RegSvcs.exe	schtasks.exe
PID 5100 wrote to memory of 2868	5100	RegSvcs.exe	schtasks.exe
PID 5100 wrote to memory of 2868	5100	RegSvcs.exe	schtasks.exe
PID 5100 wrote to memory of 2576	5100	RegSvcs.exe	schtasks.exe
PID 5100 wrote to memory of 2576	5100	RegSvcs.exe	schtasks.exe
PID 5100 wrote to memory of 2576	5100	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe
"C:\Users\Admin\AppData\Local\Temp\8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9.exe"
2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2EEF.tmp"
3⤵
- Creates scheduled task(s)
PID:2868

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2F2F.tmp"
3⤵
- Creates scheduled task(s)
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 676
2⤵
- Program crash
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2600 -ip 2600
1⤵
PID:2716

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2EEF.tmp
Filesize
1KB

MD5
40b11ef601fb28f9b2e69d36857bf2ec

SHA1
b6454020ad2ceed193f4792b77001d0bd741b370

SHA256
c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1

SHA512
e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2F2F.tmp
Filesize
1KB

MD5
0d6d94a917c4ce63da6bc50cbbe0dc5d

SHA1
599564f60649f3f4c14478e9cb184000d4280a61

SHA256
e82a4b8311319f1b68cb06ae5b670e97a11c467b1bdb0ebf130f523bf98ca522

SHA512
23ac6a088e2a1df3d75d2aca17cdcc5a4147b966758e4acc4d904293f4693f362db637d8135edd670e158bec77e788e915f2a55042a2f1aec09a4679bc749412

Download Submit
memory/2600-10-0x0000000004140000-0x0000000004144000-memory.dmp

Filesize
16KB

Download
memory/5100-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5100-12-0x00000000747C2000-0x00000000747C3000-memory.dmp

Filesize
4KB

Download
memory/5100-13-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/5100-14-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/5100-22-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/5100-31-0x00000000747C2000-0x00000000747C3000-memory.dmp

Filesize
4KB

Download
memory/5100-32-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/5100-33-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads