nanocore | 9c5c7bea6adb67e8cf158144465b6915678de6563829efd7e093413521922a35

Analysis

max time kernel
133s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-07-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vttest.2.zip
Size

157KB
MD5

0ecebb2cddc247c4bdc41f9eac5db80f
SHA1

51a50a105a4fd97395b477c07740f93f185e0e42
SHA256

9c5c7bea6adb67e8cf158144465b6915678de6563829efd7e093413521922a35
SHA512

d701c78690c2d78950e485f38bec70b0c8814c26ff969631a074522ac6d0c87df31f9c4eb66c42749a350b9dc07d3b2476450be1f5216895f71a113c747534a9
SSDEEP

3072:A/mTFG5Y/N5BuodWXQVcdi4EPhcgVLJgOl+Sc0ly/2v0Wrcl31:8mTFG5Y15Bu5QVT3P2WLtS0c/2MWg91

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

21.ip.gl.ply.gg:9388

tax-sri.gl.at.ply.gg:9388

Mutex

99fd04c9-aa00-4a36-af38-1180f6d6c1d0

Attributes

activate_away_mode
true
backup_connection_host
tax-sri.gl.at.ply.gg
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-04-22T22:24:05.419269036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9388
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
99fd04c9-aa00-4a36-af38-1180f6d6c1d0
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
21.ip.gl.ply.gg
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

vttest.2.exe

pid process

2784 vttest.2.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

vttest.2.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vttest.2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vttest.2.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

vttest.2.exe

pid	process
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe
2784	vttest.2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vttest.2.exe

pid process

2784 vttest.2.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7zG.exevttest.2.exe

description	pid	process
Token: SeRestorePrivilege	3568	7zG.exe
Token: 35	3568	7zG.exe
Token: SeSecurityPrivilege	3568	7zG.exe
Token: SeSecurityPrivilege	3568	7zG.exe
Token: SeDebugPrivilege	2784	vttest.2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

3568 7zG.exe

pid	process
3568	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\vttest.2.zip
1⤵
PID:3652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2392

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap26869:96:7zEvent28139
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3568

C:\Users\Admin\AppData\Local\Temp\vttest.2.exe
"C:\Users\Admin\AppData\Local\Temp\vttest.2.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vttest.2.exe
Filesize
202KB

MD5
96922ff790264130780d92489a232eb0

SHA1
c75d43dbb381650ec0a9684867b968bf658a0304

SHA256
a4aa9acf04e3377f7d0fd23f0677e29cf885436ee18af02de049899a9ab62d61

SHA512
0e50f48171d151aca6006f158be6d08985c62e915a5ec46fa9e9e1dc18c38112b4261209158826b15a0c48e05ac26a5af87628e6b57212c0590f962a7a06809d

Download Submit