nanocore | 2de9fa092d7c352b538462db3b0a9aa757924ad55383b24a61e797cf3cf08372

Analysis

max time kernel
121s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

130e262fc8d5700e44df1213fa857f7f.exe
Size

829KB
MD5

130e262fc8d5700e44df1213fa857f7f
SHA1

e503933d4e1906f7ad224b2e81a67a9b2ac8119e
SHA256

2de9fa092d7c352b538462db3b0a9aa757924ad55383b24a61e797cf3cf08372
SHA512

58defe66c7bb104a17c54b8da3ab4e786080f2b04b04bac8dd591131a869731d6d2a1bd249b234368c3dab7d7d49e9bfb0b15e4993b323f59319a57b27968690
SSDEEP

24576:Yg61jjk0LAta9AuDIPQJZTcwICn8VgtugrQzhu:60YZgwICtU0Shu

Score

10^/10

nanocore evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

2023endofyear.duckdns.org:15230

127.0.0.1:15230

Mutex

8c336e03-69eb-4281-b96d-2ac47eee0dc7

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-03-23T06:08:52.807981736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
15230
default_group
JUNE/24
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
8c336e03-69eb-4281-b96d-2ac47eee0dc7
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
2023endofyear.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2864 powershell.exe
2608 powershell.exe

pid	process
2864	powershell.exe
2608	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

130e262fc8d5700e44df1213fa857f7f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Host = "C:\\Program Files (x86)\\NAS Host\\nashost.exe"	130e262fc8d5700e44df1213fa857f7f.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

130e262fc8d5700e44df1213fa857f7f.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 130e262fc8d5700e44df1213fa857f7f.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

130e262fc8d5700e44df1213fa857f7f.exe

description pid process target process

PID 1744 set thread context of 2508 1744 130e262fc8d5700e44df1213fa857f7f.exe 130e262fc8d5700e44df1213fa857f7f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	130e262fc8d5700e44df1213fa857f7f.exe

description	pid	process	target process
PID 1744 set thread context of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe

Drops file in Program Files directory 2 IoCs

Processes:

130e262fc8d5700e44df1213fa857f7f.exe

description	ioc	process
File created	C:\Program Files (x86)\NAS Host\nashost.exe	130e262fc8d5700e44df1213fa857f7f.exe
File opened for modification	C:\Program Files (x86)\NAS Host\nashost.exe	130e262fc8d5700e44df1213fa857f7f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2692 schtasks.exe
2584 schtasks.exe
2960 schtasks.exe

pid	process
2692	schtasks.exe
2584	schtasks.exe
2960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

130e262fc8d5700e44df1213fa857f7f.exepowershell.exepowershell.exe130e262fc8d5700e44df1213fa857f7f.exe

pid	process
1744	130e262fc8d5700e44df1213fa857f7f.exe
1744	130e262fc8d5700e44df1213fa857f7f.exe
2608	powershell.exe
2864	powershell.exe
2508	130e262fc8d5700e44df1213fa857f7f.exe
2508	130e262fc8d5700e44df1213fa857f7f.exe
2508	130e262fc8d5700e44df1213fa857f7f.exe
2508	130e262fc8d5700e44df1213fa857f7f.exe
2508	130e262fc8d5700e44df1213fa857f7f.exe
2508	130e262fc8d5700e44df1213fa857f7f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

130e262fc8d5700e44df1213fa857f7f.exe

pid process

2508 130e262fc8d5700e44df1213fa857f7f.exe

pid	process
2508	130e262fc8d5700e44df1213fa857f7f.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

130e262fc8d5700e44df1213fa857f7f.exepowershell.exepowershell.exe130e262fc8d5700e44df1213fa857f7f.exe

description	pid	process
Token: SeDebugPrivilege	1744	130e262fc8d5700e44df1213fa857f7f.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2508	130e262fc8d5700e44df1213fa857f7f.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

130e262fc8d5700e44df1213fa857f7f.exe130e262fc8d5700e44df1213fa857f7f.exe

description	pid	process	target process
PID 1744 wrote to memory of 2608	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2608	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2608	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2608	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2864	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2864	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2864	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2864	1744	130e262fc8d5700e44df1213fa857f7f.exe	powershell.exe
PID 1744 wrote to memory of 2584	1744	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 1744 wrote to memory of 2584	1744	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 1744 wrote to memory of 2584	1744	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 1744 wrote to memory of 2584	1744	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 1744 wrote to memory of 2508	1744	130e262fc8d5700e44df1213fa857f7f.exe	130e262fc8d5700e44df1213fa857f7f.exe
PID 2508 wrote to memory of 2960	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2960	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2960	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2960	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2692	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2692	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2692	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe
PID 2508 wrote to memory of 2692	2508	130e262fc8d5700e44df1213fa857f7f.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\130e262fc8d5700e44df1213fa857f7f.exe
"C:\Users\Admin\AppData\Local\Temp\130e262fc8d5700e44df1213fa857f7f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\130e262fc8d5700e44df1213fa857f7f.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qAUEpTI.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qAUEpTI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CD0.tmp"
2⤵
- Creates scheduled task(s)
PID:2584

C:\Users\Admin\AppData\Local\Temp\130e262fc8d5700e44df1213fa857f7f.exe
"C:\Users\Admin\AppData\Local\Temp\130e262fc8d5700e44df1213fa857f7f.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "NAS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5F8E.tmp"
3⤵
- Creates scheduled task(s)
PID:2960

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "NAS Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5FEC.tmp"
3⤵
- Creates scheduled task(s)
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5CD0.tmp
Filesize
1KB

MD5
ede3d4dbfc859d8a6b51c355322444a5

SHA1
fb7298c52c3d0d314421f91b11e1abee362bc999

SHA256
d0f1fa7ff866f53106278c1b19ae76f8fce4f3c9a1d24d4145d7b05592c89328

SHA512
d002c15aa144d4e828c52fd158ec1376ae2673b036659fcd47be9acaacca3a913e286413e4d30e26a8e6ed822d21f074aa59fa5bd0f0d4d054333b882fd6782b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5F8E.tmp
Filesize
1KB

MD5
7ca5bfa8b1d5d27408930d7f42beb425

SHA1
ef4fb82a20b357e3f678ac4f8988a03fc60db2ed

SHA256
6b4072c53ba8e49354e554299945d7a9adcda2e42a13634b05ae8d9a4b05f0d7

SHA512
0dea5fa64bbd98e1515a01357110926a4a4801a3d188393c6e0630868dfbf0b21a55708d5ca8dfc8f70fb0bfc95fc42b70822f76696d91a11d486e2f1637532a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5FEC.tmp
Filesize
1KB

MD5
9f554f602c22cfc20079e966d177fadb

SHA1
789baa3425849bf239e47c6bcf352e6693a8c337

SHA256
4c760d5fe0c06cf4bf554170870f41181c61a217c37eb826903094dda86dd1f1

SHA512
b83e3e97dbe38ec4c64d9bef65e2521416f2d7434d78d05e66f729a2e0fbfea3f9bc6f6c4abaf76555af89a9565dfc0853d99067be9042dd66ed6246696eecbb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
abda5a392e1440d250d0feb13fcf50be

SHA1
e5a9dfdfd78352798fe77b5ed836e2ac6e69dadc

SHA256
af107c744fb5823a9638de0d20bac09d5ca204f0edb2ead359c808bca58a7bb4

SHA512
6393350f0713cb282284b529c62bb2a082ac3741cd6267788b489faabb0c9d8fe5bca3a54820d681c1ba373e98f86d47c88312c188803178bf27fc3386f0d0ee

Download Submit
memory/1744-30-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1744-1-0x0000000000E20000-0x0000000000EF6000-memory.dmp

Filesize
856KB

Download
memory/1744-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1744-3-0x0000000000B70000-0x0000000000B8A000-memory.dmp

Filesize
104KB

Download
memory/1744-4-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1744-5-0x0000000005C60000-0x0000000005CDC000-memory.dmp

Filesize
496KB

Download
memory/1744-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/2508-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-41-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/2508-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-24-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-38-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2508-39-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2508-40-0x0000000000660000-0x000000000067E000-memory.dmp

Filesize
120KB

Download
memory/2508-27-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2508-44-0x0000000000870000-0x0000000000882000-memory.dmp

Filesize
72KB

Download
memory/2508-45-0x0000000000D90000-0x0000000000DAA000-memory.dmp

Filesize
104KB

Download
memory/2508-46-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

Filesize
56KB

Download
memory/2508-48-0x0000000000E10000-0x0000000000E1E000-memory.dmp

Filesize
56KB

Download
memory/2508-47-0x0000000000E00000-0x0000000000E12000-memory.dmp

Filesize
72KB

Download
memory/2508-50-0x0000000002410000-0x0000000002424000-memory.dmp

Filesize
80KB

Download
memory/2508-51-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/2508-49-0x0000000002400000-0x000000000240C000-memory.dmp

Filesize
48KB

Download
memory/2508-52-0x0000000002430000-0x0000000002444000-memory.dmp

Filesize
80KB

Download
memory/2508-53-0x0000000002450000-0x000000000245E000-memory.dmp

Filesize
56KB

Download
memory/2508-55-0x00000000024E0000-0x00000000024F4000-memory.dmp

Filesize
80KB

Download
memory/2508-54-0x00000000024B0000-0x00000000024DE000-memory.dmp

Filesize
184KB

Download