nanocore | 1b0929f74cbccc7bc9a4aca3f67bf0341dd05c4c15f70ed52a959e0d57c07e7c

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
u888phz.exe
Size 203KB
Sample260623-tk4fnaet2w
SHA256 1b0929f74cbccc7bc9a4aca3f67bf0341dd05c4c15f70ed52a959e0d57c07e7c
MD5 2a5a906be1184d34d8f342d33a27966f
SHA1 d759051416659c4935ba9a16d969f8ab927e3530
SHA512 a5f02fa5cc79f77b51ffade7e8c1d239e0e5488826f4b53ffc6c5d756ba074c5dc8adb22e5cf9e17b28d014f670884a4e72f0d6a8aa5e8f7936eab679507f491
SSDEEP 6144:MLV6Bta6dtJmakIM556fA+eXcTTacsRy3Cj+o:MLV6BtpmkAuA+eXsaDCU7
TLSH
T16014CF6537E4492FE3DE8678701242028379C2E398D3F3EE28D461B69F667E44A471D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

u888phz.com:443
www.u888phz.com:443

Mutex

7c760757-1484-47aa-9fee-8befab882e32

Attributes

activate_away_mode
true
backup_connection_host
www.u888phz.com
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2026-04-04T17:49:02.890071236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
443
default_group
u888
enable_debug_mode
false
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7c760757-1484-47aa-9fee-8befab882e32
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
u888phz.com
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
9
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
4736	lansvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Service = "C:\\Program Files (x86)\\LAN Service\\lansvc.exe"	u888phz.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	u888phz.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LAN Service\lansvc.exe	u888phz.exe
File opened for modification	C:\Program Files (x86)\LAN Service\client.log	lansvc.exe
File created	C:\Program Files (x86)\LAN Service\lansvc.exe	u888phz.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u888phz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u888phz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lansvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4488	schtasks.exe
1044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe
1984	u888phz.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1984	u888phz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	u888phz.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4488	1984	u888phz.exe	91
PID 1984 wrote to memory of 1044	1984	u888phz.exe	93

C:\Users\Admin\AppData\Local\Temp\u888phz.exe
"C:\Users\Admin\AppData\Local\Temp\u888phz.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp44D4.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4488
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4542.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1044

C:\Program Files (x86)\LAN Service\lansvc.exe
"C:\Program Files (x86)\LAN Service\lansvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4736

C:\Users\Admin\AppData\Local\Temp\u888phz.exe
"C:\Users\Admin\AppData\Local\Temp\u888phz.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lansvc.exe

Path C:\Program Files (x86)\LAN Service\lansvc.exe
Size 203KB
SHA256 1b0929f74cbccc7bc9a4aca3f67bf0341dd05c4c15f70ed52a959e0d57c07e7c
MD5 2a5a906be1184d34d8f342d33a27966f
SHA1 d759051416659c4935ba9a16d969f8ab927e3530
SHA512 a5f02fa5cc79f77b51ffade7e8c1d239e0e5488826f4b53ffc6c5d756ba074c5dc8adb22e5cf9e17b28d014f670884a4e72f0d6a8aa5e8f7936eab679507f491
SSDEEP 6144:MLV6Bta6dtJmakIM556fA+eXcTTacsRy3Cj+o:MLV6BtpmkAuA+eXsaDCU7
TLSH
T16014CF6537E4492FE3DE8678701242028379C2E398D3F3EE28D461B69F667E44A471D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp44D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp44D4.tmp
Size 1KB
SHA256 f208388eafc0d12233f9c5793fcb1fa722e54873d820b272a32c302b2f8281af
MD5 24503dfd5a91e1d0616bee70b157a5c1
SHA1 710d567bbeedf36ccaba6eacb6757b771144a3e3
SHA512 bc3dc47f8c6687bb216e26118c7e4640bc1d0057e85ca3ffb98f4a122db0ecb87341b60b5aa349b3a3edc56d8aead7a7e2650fa1e026b442ec3ab670bf17b5ea
TLSH
T1F421C064ACC0F61F66715629A39297C2DE2A57A301564138FCCC4A7F3FB6186304316B
MD5 SHA1 SHA512 TLSH

Submit Download

tmp4542.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4542.tmp
Size 1KB
SHA256 1dd3aba494ff6ac9cd0437cbdeac0b0da0dea26828f45acded7d40f1b3461270
MD5 10fabfd2c6060c2db1bd6c6f3070be16
SHA1 65f418ad9715165a57efb4da44717dfcdfb71097
SHA512 9b21ce066c75fe9d4b12d8770920c51f5dcd0ba986b453fec93643f08d656b13e8d618d712414ca4dfda3f0cfad7371b3c2ad2d5620909e0ce43f1352d8a4485
TLSH
T1B621C064ACC0F65B66B15629A79197C2EF2A97A301664138FCCC4A7F2FB6186304316B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1816-14-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/1816-15-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/1816-22-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/1984-1-0x0000000074982000-0x0000000074984000-memory.dmp

Download

memory/1984-13-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/1984-0-0x0000000001130000-0x0000000001140000-memory.dmp

Download

memory/1984-16-0x0000000001130000-0x0000000001140000-memory.dmp

Download

memory/1984-17-0x0000000074982000-0x0000000074984000-memory.dmp

Download

memory/1984-23-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4736-11-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4736-12-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4736-18-0x0000000074980000-0x0000000074F31000-memory.dmp

Download

memory/4736-20-0x0000000074980000-0x0000000074F31000-memory.dmp

Download