nanocore | 4edc648c3c801e361a050a6a9325ab8c0755b20d7300712652d0d39cf3a606a2

General

Target

Cracking tutorial/Spotify Checker.exe
Size

5.4MB
MD5

1481c5c586484f3d5247cde3b1cc63a5
SHA1

25ef72d31ac28b95f5709c67e9058d729804ccea
SHA256

d84b13737ed85eec8262144d55f9b913dd6c495173a09b92f4729c0313bdf5bc
SHA512

3ce947a536ef00096376a45bc627c6c4f8b869456ed2e071ed55f1e21e959e52ee4348d60f01e527911bac2ebd2763b6c8edbd1cc431f39cfd39b305cb1ce340
SSDEEP

98304:YAJ+av4amuhNMcNucJu/n/HlxGIiT3MxGg0:nk4mAMcP4/hIw

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

174.0.39.108:3630

127.0.0.1:3630

Mutex

c6590fee-559c-4f07-930c-03e097f82346

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-02-07T23:45:22.900084736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
3630
default_group
CLIENTS
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c6590fee-559c-4f07-930c-03e097f82346
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
174.0.39.108
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
50
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

Spotify.exe

pid process

2652 Spotify.exe
Loads dropped DLL 1 IoCs

Processes:

Spotify Checker.exe

pid process

3032 Spotify Checker.exe

pid	process
2652	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Spotify Checker.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe"	Spotify Checker.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Spotify Checker.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Spotify Checker.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Spotify Checker.exe

description pid process target process

PID 3032 set thread context of 2572 3032 Spotify Checker.exe Spotify Checker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Spotify Checker.exe

description	pid	process	target process
PID 3032 set thread context of 2572	3032	Spotify Checker.exe	Spotify Checker.exe

Drops file in Program Files directory 2 IoCs

Processes:

Spotify Checker.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	Spotify Checker.exe
File opened for modification	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	Spotify Checker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Spotify Checker.exeSpotify Checker.exe

pid	process
3032	Spotify Checker.exe
3032	Spotify Checker.exe
3032	Spotify Checker.exe
3032	Spotify Checker.exe
3032	Spotify Checker.exe
2572	Spotify Checker.exe
2572	Spotify Checker.exe
2572	Spotify Checker.exe
2572	Spotify Checker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Spotify Checker.exe

pid process

2572 Spotify Checker.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Spotify Checker.exeSpotify Checker.exe

description pid process

Token: SeDebugPrivilege 3032 Spotify Checker.exe
Token: SeDebugPrivilege 2572 Spotify Checker.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Spotify.exe

pid process

2652 Spotify.exe

pid	process
2572	Spotify Checker.exe

description	pid	process
Token: SeDebugPrivilege	3032	Spotify Checker.exe
Token: SeDebugPrivilege	2572	Spotify Checker.exe

pid	process
2652	Spotify.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Spotify Checker.exe

description	pid	process	target process
PID 3032 wrote to memory of 2652	3032	Spotify Checker.exe	Spotify.exe
PID 3032 wrote to memory of 2652	3032	Spotify Checker.exe	Spotify.exe
PID 3032 wrote to memory of 2652	3032	Spotify Checker.exe	Spotify.exe
PID 3032 wrote to memory of 2652	3032	Spotify Checker.exe	Spotify.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe
PID 3032 wrote to memory of 2572	3032	Spotify Checker.exe	Spotify Checker.exe

C:\Users\Admin\AppData\Local\Temp\Cracking tutorial\Spotify Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Cracking tutorial\Spotify Checker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\Spotify.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Users\Admin\AppData\Local\Temp\Cracking tutorial\Spotify Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Cracking tutorial\Spotify Checker.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Spotify.exe
Filesize
5.1MB

MD5
0c1f43bd9162c8b774d69a8582718d21

SHA1
ad820ae823a02981eafccac9c1f4b290188b292f

SHA256
c532533100d63d221440c9a29929c8850f4c154fabba701efd1c9b5ba526f1ac

SHA512
670279317e914702371cf2b27016b132c518d94099829e60fe30b558eff8b196af9d0ab51f78e650476ef833e0740b273fce0b2616213e05b359fcf2fa372300

Download Submit
memory/2572-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-26-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-36-0x0000000002520000-0x0000000002560000-memory.dmp

Filesize
256KB

Download
memory/2572-29-0x0000000002520000-0x0000000002560000-memory.dmp

Filesize
256KB

Download
memory/2572-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-10-0x0000000000390000-0x00000000003E9000-memory.dmp

Filesize
356KB

Download
memory/2652-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2652-15-0x0000000000390000-0x00000000003E9000-memory.dmp

Filesize
356KB

Download
memory/2652-14-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2652-34-0x0000000000400000-0x0000000000930000-memory.dmp

Filesize
5.2MB

Download
memory/2652-11-0x0000000000400000-0x0000000000930000-memory.dmp

Filesize
5.2MB

Download
memory/3032-2-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-1-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-0-0x0000000074A91000-0x0000000074A92000-memory.dmp

Filesize
4KB

Download
memory/3032-12-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-33-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads