nanocore | d03270724cdd652a3c7463024b13b1d25440428a9dadd050424c9ff93a365c53

General

Target

PI_2024088_09272537_981672-HTE025783927.exe
Size

580KB
MD5

b3c9a65102bfef4a579036802b474af3
SHA1

faf15c8d7e8337e9f3b61d1943117b4f0b8a90d0
SHA256

d03270724cdd652a3c7463024b13b1d25440428a9dadd050424c9ff93a365c53
SHA512

82a91edd4e823bcbbbf6bf78483b649d90d28db048934e00b1d10c67193bb30797bb6c46b098dabe6dbdd4c16716052e2df086ed7d36f781d15fe3535f4e9261
SSDEEP

12288:Pq5X6hWBXTWLSGP1UrsCieglBGcmdzmT8QGFLSNqVTNy:PyTWLSGP1Ursd90RYIVZy

Score

10^/10

nanocore discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

134.19.179.203:35772

Mutex

c2a0762b-5f42-46f9-9b23-c2c7326d2dea

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-05-17T02:44:07.543743836Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
35772
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c2a0762b-5f42-46f9-9b23-c2c7326d2dea
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
134.19.179.203
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2444 powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exewab.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kanonfdens = "%Bassinernes% -windowstyle minimized $Inaugurations=(Get-ItemProperty -Path 'HKCU:\\Monorhine209\\').Formaliteternes;%Bassinernes% ($Inaugurations)"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Manager = "C:\\Program Files (x86)\\ARP Manager\\arpmgr.exe"	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2340 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2444 powershell.exe
2340 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2444 set thread context of 2340 2444 powershell.exe wab.exe

flow	ioc
4	drive.google.com
5	drive.google.com

pid	process
2340	wab.exe

description	pid	process	target process
PID 2444 set thread context of 2340	2444	powershell.exe	wab.exe

Drops file in Program Files directory 2 IoCs

Processes:

wab.exe

description	ioc	process
File created	C:\Program Files (x86)\ARP Manager\arpmgr.exe	wab.exe
File opened for modification	C:\Program Files (x86)\ARP Manager\arpmgr.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exewab.execmd.exereg.exeschtasks.exeschtasks.exePI_2024088_09272537_981672-HTE025783927.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PI_2024088_09272537_981672-HTE025783927.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2804 reg.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2848 schtasks.exe
872 schtasks.exe

pid	process
2804	reg.exe

pid	process
2848	schtasks.exe
872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid	process
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2444 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2444 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2444	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

PI_2024088_09272537_981672-HTE025783927.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 816 wrote to memory of 2444	816	PI_2024088_09272537_981672-HTE025783927.exe	powershell.exe
PID 816 wrote to memory of 2444	816	PI_2024088_09272537_981672-HTE025783927.exe	powershell.exe
PID 816 wrote to memory of 2444	816	PI_2024088_09272537_981672-HTE025783927.exe	powershell.exe
PID 816 wrote to memory of 2444	816	PI_2024088_09272537_981672-HTE025783927.exe	powershell.exe
PID 2444 wrote to memory of 2340	2444	powershell.exe	wab.exe
PID 2444 wrote to memory of 2340	2444	powershell.exe	wab.exe
PID 2444 wrote to memory of 2340	2444	powershell.exe	wab.exe
PID 2444 wrote to memory of 2340	2444	powershell.exe	wab.exe
PID 2444 wrote to memory of 2340	2444	powershell.exe	wab.exe
PID 2444 wrote to memory of 2340	2444	powershell.exe	wab.exe
PID 2340 wrote to memory of 2780	2340	wab.exe	cmd.exe
PID 2340 wrote to memory of 2780	2340	wab.exe	cmd.exe
PID 2340 wrote to memory of 2780	2340	wab.exe	cmd.exe
PID 2340 wrote to memory of 2780	2340	wab.exe	cmd.exe
PID 2780 wrote to memory of 2804	2780	cmd.exe	reg.exe
PID 2780 wrote to memory of 2804	2780	cmd.exe	reg.exe
PID 2780 wrote to memory of 2804	2780	cmd.exe	reg.exe
PID 2780 wrote to memory of 2804	2780	cmd.exe	reg.exe
PID 2340 wrote to memory of 2848	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 2848	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 2848	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 2848	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 872	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 872	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 872	2340	wab.exe	schtasks.exe
PID 2340 wrote to memory of 872	2340	wab.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PI_2024088_09272537_981672-HTE025783927.exe
"C:\Users\Admin\AppData\Local\Temp\PI_2024088_09272537_981672-HTE025783927.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$monopolizer=Get-Content 'C:\Users\Admin\AppData\Roaming\spidskandidater\tidsbegrnsningen\Poolene.Dyr';$Geochemist11=$monopolizer.SubString(52658,3);.$Geochemist11($monopolizer)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
3⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Kanonfdens" /t REG_EXPAND_SZ /d "%Bassinernes% -windowstyle minimized $Inaugurations=(Get-ItemProperty -Path 'HKCU:\Monorhine209\').Formaliteternes;%Bassinernes% ($Inaugurations)"
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Kanonfdens" /t REG_EXPAND_SZ /d "%Bassinernes% -windowstyle minimized $Inaugurations=(Get-ItemProperty -Path 'HKCU:\Monorhine209\').Formaliteternes;%Bassinernes% ($Inaugurations)"
5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2804

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3EA8.tmp"
4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3F16.tmp"
4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3EA8.tmp

Filesize
1KB

MD5
5ccc18c3f1852b87de26278cba055c13

SHA1
9233db8c004ac3e1b34c0782bac706a17bdc43ae

SHA256
7d588a9e361cccb0a3c97ec7ac99efe60e82932c64ab6efbfc929f51acb38432

SHA512
1ad0e9d090e93bdfa76c7ff60c5492c43265f53adf0ac23a7c831231e12822b11bae6d0840f92c8deddc9e08dbb383d24073ece791feaf36687692a437294ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3F16.tmp

Filesize
1KB

MD5
b6fc28b9f341812fc919e0d4c5ac0941

SHA1
d49341ec5a78189830dbf64b2bb553d0fbe06e88

SHA256
2aacf4d9629bbec978f5a9ecfe8009cd18cfb5dbde09507937e0aaa13b1aeaba

SHA512
166ece1d42a5f438142bc5df5f34b30ee17de5844383bb7517200ee77d77b1b8096e963739cc9188602742984d2e1dc8bc9788d8ae12010e5a05415676e29fdf

Download Submit
C:\Users\Admin\AppData\Roaming\spidskandidater\tidsbegrnsningen\Makropakker.For

Filesize
366KB

MD5
bdb605ac3e6759f2b3d4119bfa041a1b

SHA1
4fe994f73b67e65993371a04f2f30ab9d36ebf39

SHA256
67bb984b9bbd27346237b248ba932f27db8334248a83505498ce84243b6d831d

SHA512
ce3cc235df644eb9232488a1d9b1b11ac579c2b793cc1971609fa8daea1116447274560191dd001d6ab458d87dcc36588dccbbf03dc48c08f8741f9b6ec1156d

Download Submit
C:\Users\Admin\AppData\Roaming\spidskandidater\tidsbegrnsningen\Poolene.Dyr

Filesize
51KB

MD5
0555a0781d413ef9d55ae5cf7889c536

SHA1
9505dc0689854f33d4124d81733aeb2cd2436327

SHA256
ee9ed3183437cabff4add4da2238f6ca2972d7a7257545315e60aafaf90fec4b

SHA512
1d7a9ea5cab36b4d598f3c448cf8bb1640b7a5e7d962d849b235e7b42523f91b98c6759b2d3d205424f97937bf90a3d0eaa082d845f2b34cad49e160e6df3d49

Download Submit
memory/2340-41-0x0000000000720000-0x0000000001782000-memory.dmp

Filesize
16.4MB

Download
memory/2340-52-0x00000000201C0000-0x00000000201CA000-memory.dmp

Filesize
40KB

Download
memory/2340-44-0x0000000000720000-0x000000000075A000-memory.dmp

Filesize
232KB

Download
memory/2340-42-0x0000000000720000-0x0000000001782000-memory.dmp

Filesize
16.4MB

Download
memory/2444-14-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-20-0x0000000006650000-0x000000000977E000-memory.dmp

Filesize
49.2MB

Download
memory/2444-21-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-19-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-17-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-10-0x0000000074481000-0x0000000074482000-memory.dmp

Filesize
4KB

Download
memory/2444-13-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-12-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-11-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads