nanocore | 110030d023a26c770d0591ec3bb4d8a82e1f236960f616ec446543e683c9b627

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
help2.exe
Size 203KB
Sample260429-jlsenshs3x
SHA256 110030d023a26c770d0591ec3bb4d8a82e1f236960f616ec446543e683c9b627
MD5 a7d758a63249f1ac40f950f577fb12e1
SHA1 8ac852b3e2a7b2b5d424393573f3342a9b85781d
SHA512 7e09ce305502dc93da62f73523c11d8acec8b2cee4e57097af8acb0766b44193ed03d3b3dca7eccdd98b06bea98bbb3b61529162e5d026327538cbef393939fc
SSDEEP 6144:MLV6Bta6dtJmakIM5PUBPnGZd3wwMi5Tc:MLV6BtpmkkMOhwwMi1c
TLSH
T1A914CF1677E9892FE2DE86BD612241539379C2E3D8C3F3DE28D415B69B263E146070E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

almendrawinery.com:443
www.almendrawinery.com:443

Mutex

2e8dae39-06b9-4a93-8b94-e16e6701c971

Attributes

activate_away_mode
true
backup_connection_host
www.almendrawinery.com
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2026-02-08T04:09:47.547301136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
443
default_group
xoilac
enable_debug_mode
false
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2e8dae39-06b9-4a93-8b94-e16e6701c971
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
almendrawinery.com
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5015
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
4792	wansvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansvc.exe"	help2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	help2.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WAN Service\wansvc.exe	help2.exe
File opened for modification	C:\Program Files (x86)\WAN Service\wansvc.exe	help2.exe
File opened for modification	C:\Program Files (x86)\WAN Service\client.log	wansvc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wansvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3920	schtasks.exe
3956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe
752	help2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
752	help2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	help2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 3920	752	help2.exe	85
PID 752 wrote to memory of 3956	752	help2.exe	87

C:\Users\Admin\AppData\Local\Temp\help2.exe
"C:\Users\Admin\AppData\Local\Temp\help2.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6136.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3920
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6194.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3956

C:\Program Files (x86)\WAN Service\wansvc.exe
"C:\Program Files (x86)\WAN Service\wansvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4792

C:\Users\Admin\AppData\Local\Temp\help2.exe
"C:\Users\Admin\AppData\Local\Temp\help2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wansvc.exe

Path C:\Program Files (x86)\WAN Service\wansvc.exe
Size 203KB
SHA256 110030d023a26c770d0591ec3bb4d8a82e1f236960f616ec446543e683c9b627
MD5 a7d758a63249f1ac40f950f577fb12e1
SHA1 8ac852b3e2a7b2b5d424393573f3342a9b85781d
SHA512 7e09ce305502dc93da62f73523c11d8acec8b2cee4e57097af8acb0766b44193ed03d3b3dca7eccdd98b06bea98bbb3b61529162e5d026327538cbef393939fc
SSDEEP 6144:MLV6Bta6dtJmakIM5PUBPnGZd3wwMi5Tc:MLV6BtpmkkMOhwwMi1c
TLSH
T1A914CF1677E9892FE2DE86BD612241539379C2E3D8C3F3DE28D415B69B263E146070E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6136.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6136.tmp
Size 1KB
SHA256 d2248871a49dc7405ec54caab3597fb7b613faab8223cf9ad9d63ded8e49132d
MD5 1c28bb63126e059ced5aa66ae1546d9d
SHA1 fb5e4a61d3bae75a117d6031e53168636702adbe
SHA512 8d5205394ce64bf652adb484277146c51babd35919a6b833b649d2ab331e483a02efd7488e5bfeae303117dcff779282b98d7cf90f38d132e2440680759259b8
TLSH
T13C21C064BCC0F71F66715629A79197C2DE2A97A302564138FCCC4A7F3FB6186304316B
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6194.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6194.tmp
Size 1KB
SHA256 a57110ccf892c8ca9c9b28b2608f4d37a8b5df1bfcf1411e7c62b500e82fabda
MD5 9f0deb7cf87b4ae4efde9cc98ff481db
SHA1 760265641ce176e555c64bedb494f6f75fd0bd27
SHA512 6517829d9a09df437a340485bb87183c7a80135a76296308120e0ab385f5ffa7369a2ace9655ffaf1c594869cc6a20015520b6b0c681217b641b3c58127a29de
TLSH
T1B221E064ACC0F61B62B14629E39197C2EF2A87A301264138FCCC4A7F2FB6186304316B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-19-0x0000000000C70000-0x0000000000C80000-memory.dmp

Download

memory/752-9-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/752-1-0x0000000074982000-0x0000000074984000-memory.dmp

Download

memory/752-25-0x0000000000F80000-0x0000000001007000-memory.dmp

Download

memory/752-24-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/752-23-0x0000000074982000-0x0000000074984000-memory.dmp

Download

memory/752-0-0x0000000000C70000-0x0000000000C80000-memory.dmp

Download

memory/3648-17-0x00000000024C0000-0x0000000002547000-memory.dmp

Download

memory/3648-18-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/3648-13-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/3648-12-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4792-15-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4792-21-0x0000000003040000-0x00000000030C7000-memory.dmp

Download

memory/4792-22-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4792-14-0x0000000074980000-0x0000000074F31000-memory.dmp

Download