nanocore | 87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6

General

Target

Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
Size

10.8MB
MD5

f095eb0f4362f8cce158e4c51678323a
SHA1

fc173a677bab9675f21fc008b723d1432ffd3207
SHA256

87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6
SHA512

c5d08b6ec63efcbf71b11025e61985045e541bd908e91e95c9c8638374d0764e3757d9197263f4b8785dab4490682a33020dde5f6547320b832184667acd2737
SSDEEP

196608:k4VIJ7hNkHzI2cE++jj0dMfSrPfa7xWRacj2W9wpSDVj6yoO1tdqM9NSQxzaB:k4yJPJ+jPSO9WRauDVj3osR9NSZB

Score

10^/10

nanocore defense_evasion discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

4.tcp.eu.ngrok.io:15992

Mutex

24d79ee3-5a63-4154-b01d-dcb492d86e40

Attributes

activate_away_mode
true
backup_connection_host
4.tcp.eu.ngrok.io
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-12-28T00:32:11.299554136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
15992
default_group
Tisane
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
24d79ee3-5a63-4154-b01d-dcb492d86e40
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe

Executes dropped EXE 4 IoCs

pid	Process
2328	4021.exe
2244	2103.exe
2676	3333.exe
1848	876.exe

Loads dropped DLL 16 IoCs

pid	Process
2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
2328	4021.exe
2328	4021.exe
2328	4021.exe
2328	4021.exe
2244	2103.exe
2244	2103.exe
2244	2103.exe
2244	2103.exe
2676	3333.exe
2676	3333.exe
2676	3333.exe
2676	3333.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	876.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 26 IoCs

Web Service

T1102

flow	ioc
24	4.tcp.eu.ngrok.io
28	4.tcp.eu.ngrok.io
34	4.tcp.eu.ngrok.io
40	4.tcp.eu.ngrok.io
48	4.tcp.eu.ngrok.io
52	4.tcp.eu.ngrok.io
4	4.tcp.eu.ngrok.io
10	4.tcp.eu.ngrok.io
14	4.tcp.eu.ngrok.io
20	4.tcp.eu.ngrok.io
2	4.tcp.eu.ngrok.io
6	4.tcp.eu.ngrok.io
18	4.tcp.eu.ngrok.io
30	4.tcp.eu.ngrok.io
36	4.tcp.eu.ngrok.io
38	4.tcp.eu.ngrok.io
42	4.tcp.eu.ngrok.io
44	4.tcp.eu.ngrok.io
8	4.tcp.eu.ngrok.io
16	4.tcp.eu.ngrok.io
26	4.tcp.eu.ngrok.io
32	4.tcp.eu.ngrok.io
46	4.tcp.eu.ngrok.io
50	4.tcp.eu.ngrok.io
12	4.tcp.eu.ngrok.io
22	4.tcp.eu.ngrok.io

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000016e73-10.dat	autoit_exe
behavioral1/files/0x00080000000173ee-33.dat	autoit_exe
behavioral1/files/0x0008000000017474-56.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	876.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1848	876.exe
1848	876.exe
1848	876.exe
1848	876.exe
1848	876.exe
1848	876.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1848	876.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	876.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2328	2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe	30
PID 2436 wrote to memory of 2328	2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe	30
PID 2436 wrote to memory of 2328	2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe	30
PID 2436 wrote to memory of 2328	2436	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe	30
PID 2328 wrote to memory of 2244	2328	4021.exe	32
PID 2328 wrote to memory of 2244	2328	4021.exe	32
PID 2328 wrote to memory of 2244	2328	4021.exe	32
PID 2328 wrote to memory of 2244	2328	4021.exe	32
PID 2244 wrote to memory of 2676	2244	2103.exe	33
PID 2244 wrote to memory of 2676	2244	2103.exe	33
PID 2244 wrote to memory of 2676	2244	2103.exe	33
PID 2244 wrote to memory of 2676	2244	2103.exe	33
PID 2676 wrote to memory of 1848	2676	3333.exe	34
PID 2676 wrote to memory of 1848	2676	3333.exe	34
PID 2676 wrote to memory of 1848	2676	3333.exe	34
PID 2676 wrote to memory of 1848	2676	3333.exe	34

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe

C:\Users\Admin\AppData\Local\Temp\Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe
"C:\Users\Admin\AppData\Local\Temp\Sigmanly_87c8ea7512267fb8ac2b2456745d45963f2dc9ab982542655df3ef89e18a84a6.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2436
- C:\Users\Admin\AppData\Local\Temp\4021\4021.exe
  "C:\Users\Admin\AppData\Local\Temp\4021\4021.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\2103\2103.exe
    "C:\Users\Admin\AppData\Local\Temp\2103\2103.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\3333\3333.exe
      "C:\Users\Admin\AppData\Local\Temp\3333\3333.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\876\876.exe
        
        "C:\Users\Admin\AppData\Local\Temp\876\876.exe"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2103\2103.exe

Filesize
3.0MB

MD5
f4d77906eb34614289ea66c9683e96bd

SHA1
7887c38f6e4c64f09a5c47488f65cc3be07553ee

SHA256
7244395aef72261cece9b858266a3751656a01c4fd96f25ea7e4fc6b77aa313a

SHA512
1c41bc8ab340b952cc0b9b2d0095b224af6c9caf13c7d796ca285a08513fbfaf105ec3f591e697283420c390a1e0bbf7bb091614a657443245a3f673330970cc

Download Submit
\Users\Admin\AppData\Local\Temp\3333\3333.exe

Filesize
1.4MB

MD5
35fd584d7e57ab0bde1537453d6130bb

SHA1
0c719bec10d0b2e284415db59b3a3a741d8ab476

SHA256
bebbaed06e2f55881175eb24a97bc73141ea40382c61930463abde1e94e527ba

SHA512
73aeb1c8b2bae5702cca51d0ad8c3c2bad4085faef4b477ca7a16af65ea90bb70b62f04889f3ed3e6d3093357c1bedb4ce65f775b1fc10f9f671ad9e2f85f726

Download Submit
\Users\Admin\AppData\Local\Temp\4021\4021.exe

Filesize
5.7MB

MD5
44c78cb29ab3a0f083f5dda87e287b0d

SHA1
0ed686d3bb5ce3c687589db4dd2efbe55f2c88c2

SHA256
0194a7dba29d62fe979b70e944ca6ace74beb02c29aa3217099e6db896c768f8

SHA512
df211f4983883f15e3b065513750dd9c9208424b38044918d48d49d1e33c62283bc2f4340611be20554c15dd963c8be5b98f6902710bdb688ce38c3ba684f6e3

Download Submit
\Users\Admin\AppData\Local\Temp\876\876.exe

Filesize
202KB

MD5
1823024b574fcbed0ffd70e80f4a9831

SHA1
d5ce92ca3b6e39b0ab6f6deb8fa860ed0e31db8a

SHA256
ef4b4ff5cdcd1f5b95ce9af0b43b34e9584d6d4a1fcff4b5b18619c0e0c2477a

SHA512
513088b27f36170be85d1174e956e76da26d721d144322188586eeb2bff965bd43cf4c51d8f0386c15c50670bed3fadd8aeb9989568503309365c4ba077ffe35

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads