nanocore | bc2c2fce9b6d912c3eb394eba723c0f4c9a03ec70f6978d78cfe8e8269b20af3

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image.exe
Size 779KB
Sample240820-e86hlaxejl
SHA256 41e0b1de55bbfe30925144c498ee806aeb17422f4a1b867e1bf5f0c3685e892c
MD5 7349c111442a81bd317c11bc6ae54272
SHA1 60955f9f7eac98908168bbd10dea35c0562ed79b
SHA512 3eccabe6ad904fe56cf6c465a6096e868f9d8087af9f031a35d21876a016e97745f45c3e822bf63098036a39dd219406c28514c97753b48bcdb649870df91cfe
SSDEEP 12288:kGazCwgqaVouy0Pl2T5xw02/ZFxeciN9/ogrKgvFZpxJ+7ZXJUNcTEy9+Refu:kBC/qaSuyK2TEbe//s8FfxJ8ZXJNyo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore discovery evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

percolysrl2.ddns.net:50720
94.156.68.149:50720

Mutex

8db2e04d-fea6-4ac1-bc82-47d992a4c6e5

Attributes

activate_away_mode
true
backup_connection_host
94.156.68.149
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-05-28T11:54:58.690784636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
true
connect_delay
4000
connection_port
50720
default_group
PUNK
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
8db2e04d-fea6-4ac1-bc82-47d992a4c6e5
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
percolysrl2.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5009
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5008
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1048	powershell.exe
2836	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	image.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Monitor = "C:\\Program Files (x86)\\NAS Monitor\\nasmon.exe"	image.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	image.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 3168	988	image.exe	100

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NAS Monitor\nasmon.exe	image.exe
File opened for modification	C:\Program Files (x86)\NAS Monitor\nasmon.exe	image.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	image.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	image.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
988	image.exe
988	image.exe
988	image.exe
988	image.exe
988	image.exe
988	image.exe
1048	powershell.exe
988	image.exe
2836	powershell.exe
3168	image.exe
3168	image.exe
3168	image.exe
1048	powershell.exe
2836	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3168	image.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	image.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	3168	image.exe
Token: SeDebugPrivilege	3168	image.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 1048	988	image.exe	94
PID 988 wrote to memory of 1048	988	image.exe	94
PID 988 wrote to memory of 1048	988	image.exe	94
PID 988 wrote to memory of 2836	988	image.exe	96
PID 988 wrote to memory of 2836	988	image.exe	96
PID 988 wrote to memory of 2836	988	image.exe	96
PID 988 wrote to memory of 8	988	image.exe	98
PID 988 wrote to memory of 8	988	image.exe	98
PID 988 wrote to memory of 8	988	image.exe	98
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100
PID 988 wrote to memory of 3168	988	image.exe	100

C:\Users\Admin\AppData\Local\Temp\image.exe
"C:\Users\Admin\AppData\Local\Temp\image.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\image.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ornywLnqHl.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ornywLnqHl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFF0.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:8
- C:\Users\Admin\AppData\Local\Temp\image.exe
  "C:\Users\Admin\AppData\Local\Temp\image.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7e650b4637b5d4c5540c077ffd7e01475b18e906f7bb8d679fe877fc98974a34
MD5 16ada596ed69a3ef9e81b04e707e2416
SHA1 e6b0662218e03cf7b0648c4bb40319e8577bf7e6
SHA512 9559b8401c9da7b2566158c6dbf3e476328fcc893b7ee80504d1b844db06d770604e0aa2464596aea2c1c64b10d5783019c8a9efc97ab6d56bb1aba0a979b8ec
SSDEEP 384:4sf+BO9i+r4K55BBiWpLMkaMKiNITKK6seYLME/h03SoZ2fYSg0jEDkeQ0gdItk6:VfDzxosLaMXNITKNgrKSpWKEDjCq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xmgubutf.gex.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmgubutf.gex.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpDFF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDFF0.tmp
Size 1KB
SHA256 b54d852acb41019dafb684cc28c07b64be54a13119a6bc1f2684b12db16cfe3d
MD5 d683f5e8986d8bb348a0d9983b0262c9
SHA1 bfd9a4db592291bb115b2308f4de5555370aa56c
SHA512 3d3d23d728204184c9ceb2bde50681eb732701fc9f305edf946738efe475ed1e9cea3416cb2b5a27b80a95b64fd29399ebace6aae25f86a6f8eb3e65a6da3b33
MD5 SHA1 SHA512

Submit Download

memory/988-5-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/988-4-0x00000000050D0000-0x00000000050DA000-memory.dmp

Download

memory/988-6-0x0000000005350000-0x0000000005362000-memory.dmp

Download

memory/988-7-0x00000000749AE000-0x00000000749AF000-memory.dmp

Download

memory/988-8-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/988-9-0x00000000054F0000-0x0000000005500000-memory.dmp

Download

memory/988-10-0x0000000005D90000-0x0000000005E0C000-memory.dmp

Download

memory/988-11-0x0000000008BA0000-0x0000000008C3C000-memory.dmp

Download

memory/988-3-0x0000000005130000-0x00000000051C2000-memory.dmp

Download

memory/988-2-0x00000000056E0000-0x0000000005C84000-memory.dmp

Download

memory/988-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

Download

memory/988-39-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/988-1-0x0000000000620000-0x00000000006E8000-memory.dmp

Download

memory/1048-82-0x0000000006E70000-0x0000000006E8A000-memory.dmp

Download

memory/1048-59-0x0000000070EF0000-0x0000000070F3C000-memory.dmp

Download

memory/1048-20-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1048-25-0x0000000004C90000-0x0000000004CF6000-memory.dmp

Download

memory/1048-23-0x0000000004C20000-0x0000000004C86000-memory.dmp

Download

memory/1048-22-0x0000000004A80000-0x0000000004AA2000-memory.dmp

Download

memory/1048-16-0x0000000002210000-0x0000000002246000-memory.dmp

Download

memory/1048-36-0x0000000005520000-0x0000000005874000-memory.dmp

Download

memory/1048-95-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1048-19-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1048-17-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1048-89-0x0000000007190000-0x0000000007198000-memory.dmp

Download

memory/1048-87-0x00000000070B0000-0x00000000070C4000-memory.dmp

Download

memory/1048-84-0x00000000070F0000-0x0000000007186000-memory.dmp

Download

memory/1048-18-0x0000000004D70000-0x0000000005398000-memory.dmp

Download

memory/1048-56-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Download

memory/1048-57-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Download

memory/1048-80-0x0000000006D40000-0x0000000006DE3000-memory.dmp

Download

memory/1048-70-0x0000000006160000-0x000000000617E000-memory.dmp

Download

memory/1048-58-0x0000000006120000-0x0000000006152000-memory.dmp

Download

memory/2836-88-0x0000000007E60000-0x0000000007E7A000-memory.dmp

Download

memory/2836-86-0x0000000007D50000-0x0000000007D5E000-memory.dmp

Download

memory/2836-81-0x0000000008170000-0x00000000087EA000-memory.dmp

Download

memory/2836-96-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2836-83-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

Download

memory/2836-38-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2836-24-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2836-40-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2836-85-0x0000000007D20000-0x0000000007D31000-memory.dmp

Download

memory/2836-69-0x0000000070EF0000-0x0000000070F3C000-memory.dmp

Download

memory/3168-54-0x0000000005C10000-0x0000000005C2E000-memory.dmp

Download

memory/3168-52-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Download

memory/3168-55-0x0000000005C50000-0x0000000005C5A000-memory.dmp

Download

memory/3168-31-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/3168-53-0x0000000005C00000-0x0000000005C0C000-memory.dmp

Download