nanocore | ec2cf85d39dcb9a8411a8cbdf7e2fc82c6fc49485ce7d3b6f167cbc082660b04

General

Target

PO #17017.exe
Size

1014KB
MD5

64c525c7e08ca3300f95818498816e24
SHA1

b13d56f2e37126bc2b7be44e8415a21d7256f2f5
SHA256

e656ea7a50228a15fef30362bb30990e2a57415607307f7fedd7d1adb26b196c
SHA512

94dcc738aa2102bfa8e260a6e2ea160b88877cc534de578529825df032a6a37a74476120ed682ec68147bf78bb1ef49239b46f9ee63b4d9a5c9e75d7a57ec5d5
SSDEEP

24576:8NA3R5drXzJfO1M1N7Vjhhlcswuc1jZFQYcHO6lP2v5:95121M/xjVTw31jZ63wB

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

79.134.225.82:54280

Mutex

2df83afd-e34f-4f1a-8808-4301ccf4034a

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-11-24T16:56:40.784641836Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54280
default_group
TEAM NO FEAR
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2df83afd-e34f-4f1a-8808-4301ccf4034a
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
79.134.225.82
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

ntrp.exeRegSvcs.exe

pid process

3060 ntrp.exe
2736 RegSvcs.exe
Loads dropped DLL 2 IoCs

Processes:

WScript.exentrp.exe

pid process

2460 WScript.exe
3060 ntrp.exe

pid	process
3060	ntrp.exe
2736	RegSvcs.exe

pid	process
2460	WScript.exe
3060	ntrp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ntrp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "c:\\A6370V~1\\ntrp.exe c:\\A6370V~1\\itilx.vgu"	ntrp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegSvcs.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ntrp.exe

description pid process target process

PID 3060 set thread context of 2736 3060 ntrp.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1092 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

description	pid	process	target process
PID 3060 set thread context of 2736	3060	ntrp.exe	RegSvcs.exe

pid	process
1092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegSvcs.exentrp.exe

pid	process
2736	RegSvcs.exe
2736	RegSvcs.exe
2736	RegSvcs.exe
2736	RegSvcs.exe
3060	ntrp.exe
2736	RegSvcs.exe
2736	RegSvcs.exe
2736	RegSvcs.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe
3060	ntrp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

2736 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2736 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2736	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

PO #17017.exeWScript.exentrp.exeRegSvcs.exe

description	pid	process	target process
PID 1932 wrote to memory of 2460	1932	PO #17017.exe	WScript.exe
PID 1932 wrote to memory of 2460	1932	PO #17017.exe	WScript.exe
PID 1932 wrote to memory of 2460	1932	PO #17017.exe	WScript.exe
PID 1932 wrote to memory of 2460	1932	PO #17017.exe	WScript.exe
PID 2460 wrote to memory of 3060	2460	WScript.exe	ntrp.exe
PID 2460 wrote to memory of 3060	2460	WScript.exe	ntrp.exe
PID 2460 wrote to memory of 3060	2460	WScript.exe	ntrp.exe
PID 2460 wrote to memory of 3060	2460	WScript.exe	ntrp.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 3060 wrote to memory of 2736	3060	ntrp.exe	RegSvcs.exe
PID 2736 wrote to memory of 1092	2736	RegSvcs.exe	schtasks.exe
PID 2736 wrote to memory of 1092	2736	RegSvcs.exe	schtasks.exe
PID 2736 wrote to memory of 1092	2736	RegSvcs.exe	schtasks.exe
PID 2736 wrote to memory of 1092	2736	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PO #17017.exe
"C:\Users\Admin\AppData\Local\Temp\PO #17017.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\a6370v5734\nogqxvroa.vbs"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460

C:\a6370v5734\ntrp.exe
"C:\a6370v5734\ntrp.exe" itilx.vgu
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1EB7.tmp"
5⤵
- Creates scheduled task(s)
PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\A6370V~1\safjtv.cpl
Filesize
475KB

MD5
7025b90d1c3cb7427ebb11de122365ed

SHA1
b7c9680d6fb770669998cf425925b125698fa0be

SHA256
38777fe4ac318dc576daefaad95196b5ca7722b5f1e345a1b1c5b9ab4d7e3136

SHA512
72555e27bbd7607f6b0ee8e500edd8aafeeb6bd307bd1462956741387c5098c6bc6b5e8d08f72aa24cf1722f8f3420f932c3945bd9ceb94216fad0c68363dc69

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1EB7.tmp
Filesize
1KB

MD5
95aceabc58acad5d73372b0966ee1b35

SHA1
2293b7ad4793cf574b1a5220e85f329b5601040a

SHA256
8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4

SHA512
00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74

Download Submit
C:\a6370v5734\nogqxvroa.vbs
Filesize
52KB

MD5
979edc3c1cf8d25ab519e55c5247cbf4

SHA1
e8aa5eedfe506937ecd85a40b79e0fea1ad96a9e

SHA256
5ae91ec900c00a789f8fda7a6e00825eaba7bb6e99584f4dd9d0898d160b4b12

SHA512
91dddc1bc0dc6edc44a98396e9550429b9bb6abc284dc658f26ef2c3e94c378f31f06428b22c66513c3c130c70c908d9f1847aadc26061493d4e2ecd3561ffbc

Download Submit
C:\a6370v5734\ntrp.exe
Filesize
646KB

MD5
a3e8113ff31e86152d4a384dab4ea102

SHA1
28cabe6b57d14f6dd47a880c51bc9726d017989f

SHA256
d06ea150b0a83b9cf2ef63fdafc9e79a23bfa004c9f42d526499329e0ab1c977

SHA512
f34d79e3984e819c2e86e9b75c27985f7f4d8696bd3bf18447b697e127db3f76c707369336925ae941f95053d4e83d1684356d479be2295114d654bb24efb290

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Filesize
44KB

MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
memory/2736-59-0x00000000013D0000-0x00000000023D0000-memory.dmp

Filesize
16.0MB

Download
memory/2736-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-57-0x00000000013D0000-0x00000000023D0000-memory.dmp

Filesize
16.0MB

Download
memory/2736-62-0x00000000013D0000-0x000000000140A000-memory.dmp

Filesize
232KB

Download
memory/2736-60-0x00000000013D0000-0x00000000023D0000-memory.dmp

Filesize
16.0MB

Download
memory/2736-54-0x00000000013D0000-0x00000000023D0000-memory.dmp

Filesize
16.0MB

Download
memory/2736-67-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/2736-68-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/2736-69-0x0000000000690000-0x00000000006AE000-memory.dmp

Filesize
120KB

Download
memory/2736-70-0x0000000000940000-0x000000000094A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads