nanocore | d4810df62c42b3e525e4662fba9b4fe9d1916bc88087bf8ded45a00ea02680f9

General

Target

invoice.exe
Size

427KB
MD5

c9521986c45818165a3344c4ad821d17
SHA1

59360e8cda98f594c57dbec84484ef3c7a953dd9
SHA256

a68d6f1f8eac6e726187af10e2c6a7372696792cfd1b73eecbe4b77a874590a7
SHA512

da06e36625034650f93500c874c77f7d3ffa66a7d3043c01daeea74b04f5219561b43de5fb563dbd72165726e325b86f5a985a1ecbb7823766f7ffb61d13beef
SSDEEP

6144:Vs6sCfPRYwK+8sl7gNLmn8FY90SMjFWVLlIgMHxuPw+Qr8iGdPVbpqH:FPRYw0mgNLm8GezgM0cr/Go

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

kskent.dynu.net:333

127.0.0.1:333

Mutex

4d94aa95-8442-4268-a4c7-1d0109c44f55

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-02-24T03:50:49.960434136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
333
default_group
2020
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4d94aa95-8442-4268-a4c7-1d0109c44f55
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
kskent.dynu.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

invoice.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	invoice.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

invoice.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA invoice.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 4140 set thread context of 3900 4140 invoice.exe invoice.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1076 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

invoice.exeinvoice.exe

pid process

4140 invoice.exe
4140 invoice.exe
4140 invoice.exe
3900 invoice.exe
3900 invoice.exe
3900 invoice.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

invoice.exe

pid process

3900 invoice.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

invoice.exeinvoice.exe

description pid process

Token: SeDebugPrivilege 4140 invoice.exe
Token: SeDebugPrivilege 3900 invoice.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	invoice.exe

description	pid	process	target process
PID 4140 set thread context of 3900	4140	invoice.exe	invoice.exe

pid	process
1076	schtasks.exe

pid	process
4140	invoice.exe
4140	invoice.exe
4140	invoice.exe
3900	invoice.exe
3900	invoice.exe
3900	invoice.exe

pid	process
3900	invoice.exe

description	pid	process
Token: SeDebugPrivilege	4140	invoice.exe
Token: SeDebugPrivilege	3900	invoice.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 4140 wrote to memory of 1076	4140	invoice.exe	schtasks.exe
PID 4140 wrote to memory of 1076	4140	invoice.exe	schtasks.exe
PID 4140 wrote to memory of 1076	4140	invoice.exe	schtasks.exe
PID 4140 wrote to memory of 4984	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 4984	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 4984	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe
PID 4140 wrote to memory of 3900	4140	invoice.exe	invoice.exe

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FgBAmhwboOZYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6359.tmp"
2⤵
- Creates scheduled task(s)
PID:1076

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"{path}"
2⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"{path}"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\invoice.exe.log
Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6359.tmp
Filesize
1KB

MD5
c85f211eedd285a1117baa4efd18bc2b

SHA1
b345169af5ba24e3d3f0a740098b67c88b42f76b

SHA256
8c2c9c20e3ee4d53e234ad34737706412ffcdaa2fad9c319ac2aaed92c6ca060

SHA512
9e47e20700b60315f69fe4d395262aef0918953a1626c5e61433452381f69296b963d8a8b836563b9398b041d09a3c1bde88d2de1a8d01a07a9b3dd8407046fb

Download Submit
memory/3900-15-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-16-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-22-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-21-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3900-20-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-19-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-17-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/4140-4-0x0000000075482000-0x0000000075483000-memory.dmp

Filesize
4KB

Download
memory/4140-14-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/4140-1-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/4140-0-0x0000000075482000-0x0000000075483000-memory.dmp

Filesize
4KB

Download
memory/4140-13-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/4140-2-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/4140-7-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads