nanocore | 042d02ed81084afc2aa2900b4b8ad77c972cf617f5506f961ca3a046fdb09712

General

Target

2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe
Size

1.4MB
MD5

94e7fb3c3ea440611092e736d7685b6f
SHA1

22c5dcac41eae7514488c307fc83c4b00d86ea00
SHA256

042d02ed81084afc2aa2900b4b8ad77c972cf617f5506f961ca3a046fdb09712
SHA512

620ed4bd5462b02431f9e0098d6f82c64964be9799e8f897713c72d0d2ebd6eb43d0e6a08686a9df77ee7758ee63272120913c633447a1ecd83d4d7c35bbaabb
SSDEEP

24576:6NA3R5drXvdn+9rdhf2SQ0KKIlvcWNFli8nXZelYxGJ51yT9E0nu:z5F+9rdh+SQPKIBdNFY8pfxs51opnu

Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

isaacjekaguleri1234.ddns.net:57356

213.208.129.218:57356

Mutex

d81f5af0-23d5-45d4-8738-7baca2544eb1

Attributes

activate_away_mode
false
backup_connection_host
213.208.129.218
backup_dns_server
buffer_size
65538
build_time
2019-05-20T00:12:07.530934136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
57356
default_group
AUGUST MONEY
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
d81f5af0-23d5-45d4-8738-7baca2544eb1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
isaacjekaguleri1234.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
5788	gbsxq.exe
5496	gbsxq.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\32422775\\gbsxq.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\32422775\\qcpsujm.gwt"	gbsxq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Host = "C:\\Program Files (x86)\\WAN Host\\wanhost.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5788 set thread context of 3820	5788	gbsxq.exe	99

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WAN Host\wanhost.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\WAN Host\wanhost.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbsxq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbsxq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2896	schtasks.exe
3964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe
3820	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3820	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	5788	gbsxq.exe
Token: SeIncBasePriorityPrivilege	5788	gbsxq.exe
Token: SeDebugPrivilege	3820	RegSvcs.exe
Token: SeDebugPrivilege	3820	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 5060	2664	2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe	89
PID 2664 wrote to memory of 5060	2664	2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe	89
PID 2664 wrote to memory of 5060	2664	2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe	89
PID 5060 wrote to memory of 5788	5060	WScript.exe	92
PID 5060 wrote to memory of 5788	5060	WScript.exe	92
PID 5060 wrote to memory of 5788	5060	WScript.exe	92
PID 740 wrote to memory of 5496	740	cmd.exe	97
PID 740 wrote to memory of 5496	740	cmd.exe	97
PID 740 wrote to memory of 5496	740	cmd.exe	97
PID 5788 wrote to memory of 3820	5788	gbsxq.exe	99
PID 5788 wrote to memory of 3820	5788	gbsxq.exe	99
PID 5788 wrote to memory of 3820	5788	gbsxq.exe	99
PID 5788 wrote to memory of 3820	5788	gbsxq.exe	99
PID 5788 wrote to memory of 3820	5788	gbsxq.exe	99
PID 3820 wrote to memory of 2896	3820	RegSvcs.exe	102
PID 3820 wrote to memory of 2896	3820	RegSvcs.exe	102
PID 3820 wrote to memory of 2896	3820	RegSvcs.exe	102
PID 3820 wrote to memory of 3964	3820	RegSvcs.exe	104
PID 3820 wrote to memory of 3964	3820	RegSvcs.exe	104
PID 3820 wrote to memory of 3964	3820	RegSvcs.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-05_94e7fb3c3ea440611092e736d7685b6f_black-basta_luca-stealer_metamorfo.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32422775\gcnndhc.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\32422775\gbsxq.exe
    "C:\Users\Admin\AppData\Local\Temp\32422775\gbsxq.exe" qcpsujm.gwt
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "WAN Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp87FC.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2896
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "WAN Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp886B.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\32422775\gbsxq.exe C:\Users\Admin\AppData\Local\Temp\32422775\qcpsujm.gwt
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\32422775\gbsxq.exe
  C:\Users\Admin\AppData\Local\Temp\32422775\gbsxq.exe C:\Users\Admin\AppData\Local\Temp\32422775\qcpsujm.gwt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\WAN Host\wanhost.exe
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32422775\gbsxq.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\32422775\gcnndhc.vbs

Filesize
32KB

MD5
6b8c96a39bebbc8c58ebbb1dbfc2a5e8

SHA1
89dcddabf38b14b70f758275080e6746b040af3d

SHA256
343fbfe1f4b421e2ff8eda19531c809c43d0d2d6eefe55bb29ae8f808ff6fd12

SHA512
b77548d4d35d65beb3daa9604dd9316cbb8b8727e423b16bc28aba72f7996a067d3e4223e4ef06c5aafed717ddf6a1ee93634777722b3720db7193b4840ae4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\32422775\sudsi.ppt

Filesize
472KB

MD5
4607b2d7b5060860f1ae49be811667f3

SHA1
cfd3a09f8dd2463260728deecf1713384bb66d40

SHA256
2268baf402c1f88a0547d4f39ac4b10ffcb9a75869af9a98fdd2563eb96ca89f

SHA512
94c3e52e964f0bbe04e6a9f82e5efbd9ac75956b74fdbdbe6678761531b0f6bf99abc4913c56cd5ae654a6a3bf068417fd4b0c7615e9f8097db426047ab32a19

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp87FC.tmp

Filesize
1KB

MD5
8cad1b41587ced0f1e74396794f31d58

SHA1
11054bf74fcf5e8e412768035e4dae43aa7b710f

SHA256
3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c

SHA512
99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp886B.tmp

Filesize
1KB

MD5
0e2826a10e7864093e8541b9e145fabb

SHA1
bf8cc47650a76bc18afba826c913e3adca0cde4f

SHA256
ee8919d508149b90fda29ebd85507123759fb9a7aa1ab5581de93844a3b9d219

SHA512
ad952a20e4322dcbc923bc9f496ad15abd6b1f38211be79775463b1db2b04eec76477498a72aa8d97e09084e7e17e8f6b7ebcbbd5ddb17591365e70d2132a415

Download Submit
memory/3820-121-0x0000000000550000-0x0000000001550000-memory.dmp

Filesize
16.0MB

Download
memory/3820-124-0x0000000011240000-0x00000000112D2000-memory.dmp

Filesize
584KB

Download
memory/3820-125-0x00000000112E0000-0x000000001137C000-memory.dmp

Filesize
624KB

Download
memory/3820-126-0x00000000111C0000-0x00000000111CA000-memory.dmp

Filesize
40KB

Download
memory/3820-123-0x0000000011750000-0x0000000011CF4000-memory.dmp

Filesize
5.6MB

Download
memory/3820-122-0x0000000000550000-0x000000000058A000-memory.dmp

Filesize
232KB

Download
memory/3820-134-0x0000000012200000-0x000000001220A000-memory.dmp

Filesize
40KB

Download
memory/3820-135-0x0000000012290000-0x000000001229C000-memory.dmp

Filesize
48KB

Download
memory/3820-136-0x00000000122A0000-0x00000000122BE000-memory.dmp

Filesize
120KB

Download
memory/3820-137-0x00000000122D0000-0x00000000122DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads