Analysis
-
max time kernel
1050s -
max time network
1049s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2025 20:18
Behavioral task
behavioral1
Sample
NanoCore.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
NanoCore.exe
-
Size
1.1MB
-
MD5
e4aeb7b31d677a5a9a58a4762fab1321
-
SHA1
a5e7279b6d59236296031ff87976e33fbd8cf34d
-
SHA256
1111f013a010a57a6739a8d4d0891728547cbbf80e45e77369a05d3423a28915
-
SHA512
964dda5030a54493aeebb8b478a76ccd98456184224332e66d5b693d311c83da11c360355c8d73e539ebc7b6ed0d0d2e78f65eef0f75d48c64a63cf10411e1fa
-
SSDEEP
24576:sdZ1xuVVjfFoynPaVBUR8f+kN10EBIQXiClSI5tIkjh:snQDgok30Edb
Malware Config
Extracted
Family
darkcomet
Botnet
IDMAN
C2
arrivals.ddns.net:2323
Mutex
DC_MUTEX-391X2ZJ
Attributes
-
InstallPath
MSDCSC\IDMAN.exe
-
gencode
CUWbhGwmWBMb
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
IDMAN
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe" CRACKED.EXE -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile IDMAN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" IDMAN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" IDMAN.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation NanoCore.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation CRACKED.EXE -
Executes dropped EXE 3 IoCs
pid Process 4828 CRACKED.EXE 3220 NANOCORE.EXE 4404 IDMAN.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe" CRACKED.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe" IDMAN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NanoCore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRACKED.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDMAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4404 IDMAN.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4828 CRACKED.EXE Token: SeSecurityPrivilege 4828 CRACKED.EXE Token: SeTakeOwnershipPrivilege 4828 CRACKED.EXE Token: SeLoadDriverPrivilege 4828 CRACKED.EXE Token: SeSystemProfilePrivilege 4828 CRACKED.EXE Token: SeSystemtimePrivilege 4828 CRACKED.EXE Token: SeProfSingleProcessPrivilege 4828 CRACKED.EXE Token: SeIncBasePriorityPrivilege 4828 CRACKED.EXE Token: SeCreatePagefilePrivilege 4828 CRACKED.EXE Token: SeBackupPrivilege 4828 CRACKED.EXE Token: SeRestorePrivilege 4828 CRACKED.EXE Token: SeShutdownPrivilege 4828 CRACKED.EXE Token: SeDebugPrivilege 4828 CRACKED.EXE Token: SeSystemEnvironmentPrivilege 4828 CRACKED.EXE Token: SeChangeNotifyPrivilege 4828 CRACKED.EXE Token: SeRemoteShutdownPrivilege 4828 CRACKED.EXE Token: SeUndockPrivilege 4828 CRACKED.EXE Token: SeManageVolumePrivilege 4828 CRACKED.EXE Token: SeImpersonatePrivilege 4828 CRACKED.EXE Token: SeCreateGlobalPrivilege 4828 CRACKED.EXE Token: 33 4828 CRACKED.EXE Token: 34 4828 CRACKED.EXE Token: 35 4828 CRACKED.EXE Token: 36 4828 CRACKED.EXE Token: SeIncreaseQuotaPrivilege 4404 IDMAN.exe Token: SeSecurityPrivilege 4404 IDMAN.exe Token: SeTakeOwnershipPrivilege 4404 IDMAN.exe Token: SeLoadDriverPrivilege 4404 IDMAN.exe Token: SeSystemProfilePrivilege 4404 IDMAN.exe Token: SeSystemtimePrivilege 4404 IDMAN.exe Token: SeProfSingleProcessPrivilege 4404 IDMAN.exe Token: SeIncBasePriorityPrivilege 4404 IDMAN.exe Token: SeCreatePagefilePrivilege 4404 IDMAN.exe Token: SeBackupPrivilege 4404 IDMAN.exe Token: SeRestorePrivilege 4404 IDMAN.exe Token: SeShutdownPrivilege 4404 IDMAN.exe Token: SeDebugPrivilege 4404 IDMAN.exe Token: SeSystemEnvironmentPrivilege 4404 IDMAN.exe Token: SeChangeNotifyPrivilege 4404 IDMAN.exe Token: SeRemoteShutdownPrivilege 4404 IDMAN.exe Token: SeUndockPrivilege 4404 IDMAN.exe Token: SeManageVolumePrivilege 4404 IDMAN.exe Token: SeImpersonatePrivilege 4404 IDMAN.exe Token: SeCreateGlobalPrivilege 4404 IDMAN.exe Token: 33 4404 IDMAN.exe Token: 34 4404 IDMAN.exe Token: 35 4404 IDMAN.exe Token: 36 4404 IDMAN.exe Token: SeBackupPrivilege 3984 dw20.exe Token: SeBackupPrivilege 3984 dw20.exe Token: SeDebugPrivilege 4916 taskmgr.exe Token: SeSystemProfilePrivilege 4916 taskmgr.exe Token: SeCreateGlobalPrivilege 4916 taskmgr.exe Token: 33 4916 taskmgr.exe Token: SeIncBasePriorityPrivilege 4916 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4404 IDMAN.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4828 3156 NanoCore.exe 82 PID 3156 wrote to memory of 4828 3156 NanoCore.exe 82 PID 3156 wrote to memory of 4828 3156 NanoCore.exe 82 PID 3156 wrote to memory of 3220 3156 NanoCore.exe 83 PID 3156 wrote to memory of 3220 3156 NanoCore.exe 83 PID 4828 wrote to memory of 4404 4828 CRACKED.EXE 84 PID 4828 wrote to memory of 4404 4828 CRACKED.EXE 84 PID 4828 wrote to memory of 4404 4828 CRACKED.EXE 84 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 4404 wrote to memory of 1040 4404 IDMAN.exe 85 PID 3220 wrote to memory of 3984 3220 NANOCORE.EXE 86 PID 3220 wrote to memory of 3984 3220 NANOCORE.EXE 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Roaming\CRACKED.EXE"C:\Users\Admin\AppData\Roaming\CRACKED.EXE"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe"C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵
- System Location Discovery: System Language Discovery
PID:1040
-
-
-
-
C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 12043⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4916
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2936
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
659KB
MD594c5b3199414b8fca9f134724acdd88e
SHA16c95291364476fc10c4e343120225dae72d11233
SHA256dacd09444e389359d406450312e5fe66a2eb62c5c03948c8e7890303a43ee536
SHA5125fdbaf9ede009cbfdb13a92ba5c409b1a590b1bc1ddccec45c551deb5e7b7f9ecc57ed0dd1a66c7a38666bd5eb2cab9fc52a18056a5e676c292bab871aa343e1
-
Filesize
403KB
MD5d902fb22b92a7455eeac95712e9c2179
SHA18e4e0d0965055517c1ddef8442cf74c4f3d700af
SHA25658f962401b52e043325cec66d88ad73032165cd0b8c3de1ec95292d83416b81f
SHA512d097b22e30c20322c30f464dabf5bffeedc3e3728b82911db5f3ba79735915a3bb0fbc4bce65a153f665dc5e04ba93b6000d4230f8610bd17dbe3d625dff4269