nanocore | 70080f17f8524579d75e3355fe382d6768e2d0e85d3cb46d11c40dfea95eb056

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Electronic Shipping Documents 7.exe
Size

1.3MB
MD5

47b43d314ed8b13f544eac2efe4188ae
SHA1

005522096d1e202550694aa3adad7762cede9caa
SHA256

73b4db5a6d653d9d84e881b1bc8a8af6ca9efc59191c629997dab77c429213cb
SHA512

6b1437443b325022e6113fb939ab1c2ce86ee53066b66a432d33d90317d3b31cc1e136f60ea3cc8d5f0de16d9387abaa79d8e552a73d1e9fd1a44fa89ab07f2b
SSDEEP

24576:nKojMQH6/7PRia0ivVYGoBvcXsb5rz0D6rA0CJ24spJW:nKr7/jvTVCJc8FrwD6rsJ7s

Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

178.175.138.225:1869

Mutex

d40060f0-8457-4d97-a09d-62e84457e4c8

Attributes

activate_away_mode
true
backup_connection_host
178.175.138.225
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2016-10-25T10:24:17.752176236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1869
default_group
GROUP
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
d40060f0-8457-4d97-a09d-62e84457e4c8
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
178.175.138.225
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LWdfBWaDZGSh.lnk	KEYC.exe

Executes dropped EXE 2 IoCs

pid	Process
4388	UMZVVY~1.EXE
3108	KEYC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Electronic Shipping Documents 7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Service = "C:\\Program Files (x86)\\AGP Service\\agpsv.exe"	RegSvcs.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000a000000023cac-3.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3108 set thread context of 5000	3108	KEYC.exe	88

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AGP Service\agpsv.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\AGP Service\agpsv.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KEYC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Electronic Shipping Documents 7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UMZVVY~1.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4508	Electronic Shipping Documents 7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe
2248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
4388	UMZVVY~1.EXE
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
5000	RegSvcs.exe
5000	RegSvcs.exe
5000	RegSvcs.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe
3108	KEYC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5000	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4388	4508	Electronic Shipping Documents 7.exe	84
PID 4508 wrote to memory of 4388	4508	Electronic Shipping Documents 7.exe	84
PID 4508 wrote to memory of 4388	4508	Electronic Shipping Documents 7.exe	84
PID 4388 wrote to memory of 3108	4388	UMZVVY~1.EXE	87
PID 4388 wrote to memory of 3108	4388	UMZVVY~1.EXE	87
PID 4388 wrote to memory of 3108	4388	UMZVVY~1.EXE	87
PID 3108 wrote to memory of 5000	3108	KEYC.exe	88
PID 3108 wrote to memory of 5000	3108	KEYC.exe	88
PID 3108 wrote to memory of 5000	3108	KEYC.exe	88
PID 3108 wrote to memory of 5000	3108	KEYC.exe	88
PID 3108 wrote to memory of 5000	3108	KEYC.exe	88
PID 5000 wrote to memory of 2268	5000	RegSvcs.exe	90
PID 5000 wrote to memory of 2268	5000	RegSvcs.exe	90
PID 5000 wrote to memory of 2268	5000	RegSvcs.exe	90
PID 5000 wrote to memory of 2248	5000	RegSvcs.exe	92
PID 5000 wrote to memory of 2248	5000	RegSvcs.exe	92
PID 5000 wrote to memory of 2248	5000	RegSvcs.exe	92

C:\Users\Admin\AppData\Local\Temp\Electronic Shipping Documents 7.exe
"C:\Users\Admin\AppData\Local\Temp\Electronic Shipping Documents 7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UMZVVY~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UMZVVY~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Users\Admin\AppData\Roaming\KEYC.exe
    "C:\Users\Admin\AppData\Roaming\KEYC.exe" "C:\Users\Admin\AppData\Roaming\ESGJB"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9990.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2268
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp99FF.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ESGJB

Filesize
391KB

MD5
c5d74e2ba32c5718790ee1ee626296be

SHA1
c83414d93799b739338645be75b217346d9f25ad

SHA256
e4ca081e9f217d68a302664f23b939bcf733a7672238fe254945bf6269faf538

SHA512
bd0740cb9283e18382b2bbd551fd8f66b7d8b3b99c6e25e0048e08b21f6d7b4196ed4fbce486102036178d37db9bdd5bc95507042c6c1e39ab461ea7b132eb1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KEYC1

Filesize
915KB

MD5
4744edba858885bfe4d513e5ba6030ac

SHA1
7706ebc3097465571daf5bc0c26721a79e8b50c2

SHA256
b71c08e936ab72a27a822e2984a60e798591d2b71b352875f6aede464245724b

SHA512
14cf08f1227f320e36ed9b50de68fffea72393f59b921e81ad987f8cd19d9b3766f601063df474b99b6b948a8431232c900577ab633a3d8f13de0b2f69a36685

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UMZVVY~1.EXE

Filesize
1.7MB

MD5
e5e120aadb154f5a8fc4f4a9df91e0f2

SHA1
22cbf63148bf071fea74007269304c16ef5851b7

SHA256
5ac8b0c3f90a587b4ad18ef940ceb65ed1a1b0e689a72d82fb66fc50a675c58d

SHA512
ac035bbe43cc1c9fe432a38dcf4561f4111b09910b47f1021aa920d28858dc3c292aeecc7682a4ad270fd37564be51e47b0ea6a654e299a8c120ff4c7df13a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9990.tmp

Filesize
1KB

MD5
8cad1b41587ced0f1e74396794f31d58

SHA1
11054bf74fcf5e8e412768035e4dae43aa7b710f

SHA256
3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c

SHA512
99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp99FF.tmp

Filesize
1KB

MD5
7a81ae69c04c8d95261eb5f490b7f869

SHA1
9f4f484d306fea15b2e7f9f16db660833bb1f8ce

SHA256
ce3933e772f663a834335cc2071e5e7b2d49a065b51d84a259054b8ef663e785

SHA512
8260ab83106752a488e164bbed63ef334d34399bc9a5c09a0cfceba6aef48eafe5c64e4dfbd353ac3edfff2523b16c2b0287d34833a293c4436e068fae656de8

Download Submit
C:\Users\Admin\AppData\Roaming\ESGJB

Filesize
293KB

MD5
07a65d1d74825ead4f5e33c53ea7cf38

SHA1
c910017e06cec1a41fab4553139c6f9d35961130

SHA256
bd3c33414eddeceaa14f3f12e342e195a5477f20a1c63035e84cbc3d4c1e9420

SHA512
40c24e08df6a7cc34409f18fad5fc4e9fa495f4f69c0bef0b9ac4dc1a9a749312d09eec1e009fceabae5a45341c12c57c1e975edeed262375b1602ed4a4971dc

Download Submit
C:\Users\Admin\AppData\Roaming\KEYC.exe

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
memory/3108-53-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-51-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-54-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-50-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-56-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-57-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-52-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-55-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-44-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-45-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-46-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-47-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-48-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/3108-49-0x0000000000030000-0x000000000011B000-memory.dmp

Filesize
940KB

Download
memory/5000-31-0x0000000004FE0000-0x0000000005072000-memory.dmp

Filesize
584KB

Download
memory/5000-43-0x0000000006320000-0x000000000632A000-memory.dmp

Filesize
40KB

Download
memory/5000-42-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/5000-41-0x0000000005570000-0x000000000557A000-memory.dmp

Filesize
40KB

Download
memory/5000-33-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Filesize
40KB

Download
memory/5000-32-0x0000000005080000-0x000000000511C000-memory.dmp

Filesize
624KB

Download
memory/5000-30-0x0000000005590000-0x0000000005B34000-memory.dmp

Filesize
5.6MB

Download
memory/5000-28-0x0000000000920000-0x0000000000958000-memory.dmp

Filesize
224KB

Download