nanocore | d3314b427c2ff9c360df0eb831da8c13a7f2c919948716680c25bb721daa5ef0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

-09876543456789.exe
Size

1.5MB
MD5

ca48db3ce08860333f534588b8d52bae
SHA1

91d76c46a7f96ca1e7bab61d06cbeeb859bb8ef3
SHA256

8b6b44f37521a7b98f55882558648efdfec86cb745d491d1b3b3d55c69723dbf
SHA512

e0915a9a6fcfd601756e81b85f7c6b77ee01499736233701ba7936c735eb46324f127abd7b11756e43fcf85c5b822cb4223d13f91c4766aaff18b0f4c3b311e3
SSDEEP

24576:Jtb20pkaCqT5TBWgNQ7aLxKSj8CNZfRmiFGcDNrZ6A:aVg5tQ7aLxhpZZmiDT5

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

pharmzone.hopto.org:1010

79.134.225.72:1010

Mutex

4226277e-f2be-43a6-87c9-f5164ec5bb36

Attributes

activate_away_mode
true
backup_connection_host
79.134.225.72
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-02-03T16:02:10.835552936Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1010
default_group
@FILE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4226277e-f2be-43a6-87c9-f5164ec5bb36
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
pharmzone.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Drops startup file 1 IoCs

Processes:

-09876543456789.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dusmtask.url -09876543456789.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

MSBuild.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" MSBuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

-09876543456789.exe

description pid process target process

PID 2240 set thread context of 2132 2240 -09876543456789.exe MSBuild.exe
Drops file in Program Files directory 2 IoCs

Processes:

MSBuild.exe

description ioc process

File created C:\Program Files (x86)\DDP Service\ddpsv.exe MSBuild.exe
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2688 schtasks.exe
2600 schtasks.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dusmtask.url	-09876543456789.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe"	MSBuild.exe

description	pid	process	target process
PID 2240 set thread context of 2132	2240	-09876543456789.exe	MSBuild.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Service\ddpsv.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\DDP Service\ddpsv.exe	MSBuild.exe

pid	process
2688	schtasks.exe
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

MSBuild.exe-09876543456789.exe

pid	process
2132	MSBuild.exe
2132	MSBuild.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

2132 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2132 MSBuild.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

-09876543456789.exe

pid process

2240 -09876543456789.exe
2240 -09876543456789.exe
2240 -09876543456789.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

-09876543456789.exe

pid process

2240 -09876543456789.exe
2240 -09876543456789.exe
2240 -09876543456789.exe

description	pid	process
Token: SeDebugPrivilege	2132	MSBuild.exe

pid	process
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe

pid	process
2240	-09876543456789.exe
2240	-09876543456789.exe
2240	-09876543456789.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

-09876543456789.exeMSBuild.exe

description	pid	process	target process
PID 2240 wrote to memory of 2132	2240	-09876543456789.exe	MSBuild.exe
PID 2240 wrote to memory of 2132	2240	-09876543456789.exe	MSBuild.exe
PID 2240 wrote to memory of 2132	2240	-09876543456789.exe	MSBuild.exe
PID 2240 wrote to memory of 2132	2240	-09876543456789.exe	MSBuild.exe
PID 2240 wrote to memory of 2132	2240	-09876543456789.exe	MSBuild.exe
PID 2240 wrote to memory of 2132	2240	-09876543456789.exe	MSBuild.exe
PID 2132 wrote to memory of 2688	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2688	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2688	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2688	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2600	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2600	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2600	2132	MSBuild.exe	schtasks.exe
PID 2132 wrote to memory of 2600	2132	MSBuild.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\-09876543456789.exe
"C:\Users\Admin\AppData\Local\Temp\-09876543456789.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpADEB.tmp"
3⤵
- Creates scheduled task(s)
PID:2688

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB1A4.tmp"
3⤵
- Creates scheduled task(s)
PID:2600

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpADEB.tmp
Filesize
1KB

MD5
ae766004c0d8792953bafffe8f6a2e3b

SHA1
14b12f27543a401e2fe0af8052e116cab0032426

SHA256
1abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540

SHA512
e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB1A4.tmp
Filesize
1KB

MD5
93d357e6194c8eb8d0616a9f592cc4bf

SHA1
5cc3a3d95d82cb88f65cb6dc6c188595fa272808

SHA256
a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713

SHA512
4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

Download Submit
memory/2132-16-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-17-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2132-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2132-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2132-15-0x0000000073FE1000-0x0000000073FE2000-memory.dmp

Filesize
4KB

Download
memory/2132-29-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2132-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2132-28-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-25-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-26-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-27-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/2240-4-0x0000000002D20000-0x0000000002D86000-memory.dmp

Filesize
408KB

Download
memory/2240-3-0x0000000002690000-0x00000000026F6000-memory.dmp

Filesize
408KB

Download