NanoCore Hunter:
Track NanoCore C&C Server and Monitor RAT
Operator for 180 Days
National Institute of Information and Communications Technology
Cybersecurity Laboratory, Cybersecurity Research InstituteTakashi Matsumoto1Motivation• New Approach to Detecting NanoCore C2 Servers• We have found a way to detect the NanoCore C2 servers• Long-term observations of NanoCore C2 servers• The USA and Europe have most of the C2 servers• The list of C2s is provided to the national CERTs• Experiments to entice NanoCore operators• Many operators stole email account/passwords• Infected RATs other than NanoCore for a secondary infection2About NanoCore

3Overview of NanoCore RAT• This Remote Access Trojan (RAT) first appeared in 2013
• Still active in 2020
• Always ranked in the top 10 among malware trends (ANY.RUN, MalwareBazaar)• Our ​organization regularly receives NanoCore-attached spams

Top 10 Malware programs (MalwareBazaar by abuse.ch)

Malware Trends Tracker (ANY.RUN)

4

Overview of NanoCore RAT• NanoCore Functionalities• Screen sharing• Data exfiltration (files, passwords, credentials)• Keylogger• Access to microphones and webcams, etc.
• NanoCore v1.2.2.0• Latest version• Widely used by RAT operators• A cracked version was leaked and could be easily obtained• We will use this version in this work

Leaked NanoCore v1.2.2.0

5

Presentation Only

6

Presentation Only

7

Presentation Only8

Tracking NanoCore C2 Servers

9

Presentation Only

10

NSE Script for Detecting NanoCore C2• Custom NSE script• Steps to detect NanoCore C2
1.
2.
3.

Send payload that mimics NanoCore client’s initial communication
Decrypt returned data with DES
If the decryption is successful, it is judged as a NanoCore C2• Payload (NanoCore encrypts the following data using DES)
• GUID (used to identify the PC; could be a random value each time)• Identity (hostname¥username)• NanoCore group name (default name: Default)• NanoCore version (default value: 1.2.2.0)
DES
encryption

A part of nanocore.nse11

Long-Term Observations of C2 Servers (1/5)• Period• 05-14-2020 to 11-10-2020

Presentation Only
• Detected NanoCore C2 servers• Unique IP addresses: 2,075• Unique ports: 3,671• Popular Port Number• 54984/tcp: Default for NanoCore C2• 1085/tcp: leaked NanoCore v1.2.2.0 had this port open
• 1604/tcp: Same as the default port of DarkComet RAT?
Operators who were using DarkComet RAT have
moved to use NanoCore?

54984
1604
1608
5353
123
500
3306
1085
1337
4782

340
116
68
59
50
39
39
35
32
31
0

100

200

Top 10 ports

300

400

12

Long-Term Observations of C2 Servers (2/5)• By country• 85 countries hosted NanoCore C2s• The USA and Europe have most of the C2 servers• The operator‘s hometown? Same groups?

• The operator's favorite VPN or proxy service available?
• Those countries are the target of the attack?
United States (US)401

Netherlands (NL)244

France (FR)178

Germany (DE)

158

Switzerland (CH)153

Sweden (SE)123

United Kingdom (GB)117

Russia (RU)

75

Canada (CA)51

Turkey (TR)

47
050

100

150

200

250

Top 10 countries

300

350

400

450

Heat map showing the number of countries where C2servers are hosted13

Long-Term Observations of C2 Servers (3/5)
38500• By time
38000
37500
• Most of the servers were running between 9:00 and 18:00 37000• Related to the Nigerian adversaries (SilverTerrier)?
• https://attack.mitre.org/groups/G0083/• https://unit42.paloaltonetworks.com/silverterrier-2019-update/

36500
36000
35500
35000
34500
34000

0:00
1:00
2:00
3:00
4:00
5:00
6:00
7:00
8:00
9:00
10:00
11:00
12:00
13:00
14:00
15:00
16:00
17:00
18:00
19:00
20:00
21:00
22:00
23:00

• RAT operator’s working hours?
• Countries where these times are during the daytime are targetedTotal number of open ports
for every hour of every day

SilverTerrier is a Nigerian threat group
Nigerian time zone is UTC+1

SilverTerrier used NanoCore

SilverTerrier, Group G0083 | MITRE ATT&CK14

Long-Term Observations of C2 Servers (4/5)• C2 addresses in VirusTotal• Unregistered: 480 IP addresses• Registered: 1,812 IP addresses• Malware associated with registered IP addresses• RATs other than NanoCore were used
• May be using multiple RATs in conjunction?

NanoCore
RemcosRATAsyncRATNetWireAveMariaRATnjrat
GuLoaderModiLoaderAdwind
BitRAT
QuasarRAT
XpertRAT
RevengeRAT
RaccoonStealer
AgentTesla• Coordination• We have provided the list of C2s to JPCERT/CC monthly• JPCERT/CC has provided the C2 data to national CSIRTs:•••••

United States
Netherlands
Switzerland
FranceGermany

•
••
•
•

SwedenUnited Kingdom
RussiaTurkeyIndonesia

••
•
•
•

1074
358
205
150
118
85
73
43
26
23
18
16
12
11
10
0

200

400

600

800

1000

1200

Malware associated with registered IP address(VirusTotal and MalwareBazaar)

CanadaEgyptItaly
RomaniaSouth Korea••

Thailand
Colombia

15Long-Term Observations of C2 Servers (5/5)• Use of non-logging VPNs
• About 20% of the IPs are associated “The PRIVACYFIRSTProject”• According to GovCERT.ch, “We did inform the netblockowners in the past but to no avail.”• Provide NanoCore IoCs using MISP
• Add the IP address and port of the detected NanoCore
C2 server daily• Shared to the CIRCL MISP Community

The PRIVACYFIRST Project（privacyfirst.sh）

Whois results
16

Enticing NanoCore Operators

17

Revealing the Purpose of Using NanoCore• ​What do they use NanoCore for?
-> We tried revealing their purpose by enticing operators into the analysis environment• Experiments to entice RAT operators• Use the IP addresses and ports of the detected NanoCore C2 servers• Monitor operator actions in real time
Monitoring
Commands

AnalystNanoCore
ClientNanoCore
C2 Server

RAT
Operator
18

Things to Consider to Entice RAT Operators• Not all operators are active even if

Operator

the server is online

...

...

c2 servers

More than 200 servers online• ​Prepare a client to connect to the C2server

Serverbuild Client
NanoCoreBuilder• Prepare an environment which isattractive to operators

Contents:Mails, Files, Apps etc.

EnterpriseNetwork• Never be a stepping stones forattacking others

ClientServerMonitoring
19

Our System to Efficiently Entice Operators
Victim PCs
on Analysis System

NanoCore
Builder(1) Build NanoCore
clients myself withthe proxy’s IP address
and port

NanoCore
Proxy::

5-10 PCsAll Detected NanoCore
C2 Servers(3) Redirects the received
operator's commands to theclientInternet
Decrypt and checkthe commands

Redirectthe commands(2) Connect to all detected
NanoCore serversxxx.xxx.xxx.xxx, aaa/tcp:

yyy.yyy.yyy.yyy, bbb/tcp::

zzz.zzz.zzz.zzz, ccc/tcp

Our System

NanoCore
Database

NanoCore Client
NanoCore Server

20

NanoCore Proxy - Procedure (1/8)• Builds NanoCore clients with the proxy’s IP address and port
• Keeps the built clients running on the Victim PCs
Victim PC

NanoCore Proxy

C2

Build clients
NanoCore
Builder

Running clients

NanoCore
Database
21

NanoCore Proxy - Procedure (2/8)• Starts NanoCore Proxy• Passes the NanoCore Server’s IP addresses and ports to the proxy
Victim PC

NanoCore Proxy

C2

NanoCore
Builder

NanoCore
Database

NanoCore Server’s
IP Addresses and Ports
22

NanoCore Proxy - Procedure (3/8)• Starts the FakeServerThreads and start communicating with the NanoCore

clients

Victim PC

NanoCore Proxy

C2

NanoCore
Builder

FakeServerThread
NanoCore
Database
23

NanoCore Proxy - Procedure (4/8)• Starts FakeClientThreads and start communicating with all the C2 servers• Communication between the C2 server and the proxy is always decrypted
Victim PC

NanoCore Proxy

C2

NanoCore
Builder

NanoCoreDatabase

FakeClientThread24

NanoCore Proxy - Procedure (5/8)• When an operator’s command is received, it is redirected to the PC targeted

for be infected

Victim PC
Reserved

NanoCore Proxy

Operator’sCommand

C2

Redirect
Operator’sCommand

NanoCore
Builder

Note:‘Operator’s Command’ isNanoCore
Databasea communication other than the firstcommunication or a periodic
communication.
25

NanoCore Proxy - Procedure (6/8)• When an operator’s command is received, it is redirected to the PC targeted

for be infected

Victim PC

NanoCore Proxy

C2

Reserved

NanoCore
Builder

ReservedRedirect

Operator’sCommandOperator’sCommand

Note:‘Operator’s Command’ is
NanoCore
Databasea communication other than the firstcommunication or a periodic
communication.
26

NanoCore Proxy - Procedure (7/8)• When all the victim PCs have been reserved, the acceptance of new commands

will end

Victim PC

NanoCore Proxy

C2

Reserved

NanoCore
Builder

Reserved

NanoCore
Database27

NanoCore Proxy - Procedure (8/8)• The reserved client keeps connected to the c2 server and continues to analyze

Victim PC

NanoCore Proxy

C2

Reserved

NanoCore
Builder

Reserved

NanoCore
Database
28Set-up for Analyzing Actions of Operators• Used ‘STARDUST’, a large-scale infrastructure for luring cyber attackers• Available Logs
• pcap, Screenshots, Endpoint logs, Disk Forensics, etc.

• Configuration of victim PCs• OS:• Windows7 x64• language: Japanese• Installed apps:• Chrome, MS Office 2013, Adobe Reader, etc.
• Filter Driver (analysis tool)• Contents:• Mail inbox, Beacon Files (doc, xlsx, pptx, pdf),
Browser History, etc

Architecture of mimetic enterprise network ‘STARDAST’

http://www.nict.go.jp/en/data/nict-news/NICT_NEWS_2018-472_E.pdf (page. 8-9)...
NanoCore
NanoCore
Victim PCs
Builder on Analysis System
Proxy

NanoCore C2 Servers29

Summary of NanoCore Operator Actions
In this experiment, we confirmed 88 intrusions• Operators who have achieved one or more of these objectives: 53• Screen sharing and email account/passwords theft were common• They used built-in browser or mailer to find interested users• They used secondary malware occasionally• Operators who have left: 35• only screen sharing: 17• screen sharing and check the browser: 8• only shutdown: 3• uninstall client, locked the screen, etc: 7

Classification of operator actions
Category
SCREEN SHAREINGPASSWORDSFILESBROWSERMALWARE
MAIL
UNINSTALLTOOLSSHUTDOWNMISCCounts76
3724181276551630

List of NanoCore Operator Actions
Category

Behavior

Category

Behavior

Mail

Open Outlook

File access

Open a folder or file on the desktop

BrowserCheck inbox folder

Open the recently viewed location

Check for sent items

Compress Files

Check draft messages

Check the network drive

Check user’s account information

Upload files to the server

Search for specific emailInstall and execute another malware

Try to send e-mails

Update NanoCore clientOpen Chrome or Internet Explorer

Uninstall NanoCore client

Check Google account login status

Search by "Search for programs and files"

Change the language setting to English
Check user’s bookmarks

Open the bookmarked page
Open a specific page (PayPal, Alibaba, xvideos, etc.)
Check user’s browsing history

AccountInformation

Steal the password stored in the browser

NetworkConnection

Right-click on the network icon in the taskbar

Commands

run ipconfig, net view

Download a specific tool
Check frequently visited pages or recently closed tabs

Privilege

Request privilege escalation

Steal account information stored in Mailer
Check the Network and Sharing Center in the Control Panelrun systeminfo

OthersTalk to us using NjRAT chat tool

Lock the screen to disrupt user’s operation

31

Secondary Malware
Category

Name

Note

Classifiable Malware

AsyncRAT

https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp

LimeRAThttps://github.com/NYAN-x-CAT/Lime-RAT

Lokibot-Morphine-

NetWire-NjRAT-Orcus-

Remcos-VenomRAT

variant of https://github.com/mirkoBastianini/Quasar-RAT ?

Unknown(worm)Spreads using autorun.inf
Tamper with the legitimate file so that it can be invoked via a worm

Unknown

Solely execute “taskkill /f /im svchost.exe” ?

Unknown32

Tools and Techniques
CategoryName

NoteTools

Disable-Windows-Defender

https://github.com/NYAN-x-CAT/Disable-Windows-Defender

Chrome-Password-Recovery

https://github.com/0xfd3/Chrome-Password-Recovery

LastActivityView

https://www.nirsoft.net/utils/computer_activity_view.html

Mail PassView (NanoCore’s default feature)https://www.nirsoft.net/utils/mailpv.html

WebBrowserPassView (NanoCore’s default feature)https://www.nirsoft.net/utils/web_browser_password.html

AnyDesk

https://anydesk.com/TeamViewer

https://www.teamviewer.com/

Microsoft AMSI
(Antimalware Scan Interface) Bypass

Patch AmsiScanBuffer of amsi.dll to bypass scanning
Similar code: https://github.com/rastamouse/AmsiScanBufferBypass/blob/master/ASBBypass/Program.cs

HideProc

Inject taskmgr.exe and hide process name that start with asz$

Techniques

33

NanoCore Operator Actions• Case1:

The operator shared the screen and stole the password(Most common action)• Case2:

The operator carefully checked the browser and mailer• Case3:The operator attempted to infect multiple RATs

34

NanoCore Operator Actions – Case 1
Case 1: The operator shared the screen and stole the password(Most common action)• Duration• 06-15-2020 16:32:00 ~ 16:34:00 (UTC+9)• Actions• Performed screen sharing• Recover Passwords (NanoCore Surveillance Plugin)• Stole outlook 2013 credentials• Tried to steal browser passwords• Uninstalled NanoCore client

35

NanoCore Operator Actions – Case 1• Took control of the screen through screen sharing ;however, did not manipulate the screen• Recover Passwords (NanoCore Surveillance Plugin)• Stole outlook 2013 credentials• Tried to steal browser passwords• Used Nirsoft’s “Mail PassView”

https://www.nirsoft.net/utils/mailpv.html• Used Nirsoft’s “WebBrowserPassView”

https://www.nirsoft.net/utils/web_browser_pas
sword.html• I did not save passwords in the browser,
Mail address
Password

therefore it was not stolen36

NanoCore Operator Actions – Case 2
Case 2: ​The operator carefully checked the browser and mailer• Duration• 07-08-2020 16:07:10 ~ 16:56:47 (UTC+9)• Actions• Performed screen sharing• Opened folders on the desktop• Checked the network connection• Opened Outlook again and again• Looked at the email list slowly• Checked the sender’s e-mail address• Checked the user’s Outlook account settings• Searched e-mails with the keywords ‘AL’ and ‘alibaba’• Enlarge the mail view
• Checked the taskbar• Opened Chrome again and again• Typed ‘alibaba.com’ in the address bar• Visited Alibaba’s ‘Sign In’ page
• Checked Chrome login status• Opened ‘yelp.com’ from bookmark• Checked installed Chrome Apps
• Changed the language setting to English• Opened the start menu
• Searched with keywords: ‘al’, ‘english’• Clicked the shutdown button
37

NanoCore Operator Actions – Case 2• Used Chrome and Outlook alternately• Opened Chrome-> Opened ‘alibaba.com’ page-> Moved to ‘Sign In’ page-> Opened Outlook 2013-> Slowly browsed the list of messages-> Searched e-mails with the keywords ‘ALI’ and ‘alibaba’• Did he/she tried to create an account using the stolen

email address?

38

NanoCore Operator Actions – Case 3
Case 3: The operator attempted to infect multiple RATs
• Duration• 10-08-2020 15:38:44 ~ 15:44:27 (UTC+9)• 10-13-2020 14:52:27 ~ 15:03:54 (UTC+9)• Actions• Performed screen sharing• Installed and executed another malware• NjRAT, AsyncRAT, Remcos• Ran a tool to disable Windows security feature• Disable-Windows-Defender:
https://github.com/NYAN-x-CAT/Disable-Windows-Defender• Microsoft AMSI (Antimalware Scan Interface) Bypass

39

NanoCore Operator Actions – Case 3• FIRST DAY: 10-08-2020 15:38:44 ~ 15:44:27 (UTC+9)• Took control of the screen through screen sharing ; however, did not manipulate the screen• Executed NjRAT and ‘Disable-Windows-Defender’

NjRAT••

Microsoft AMSI Bypass
Win7 did not have amsi.dll, which was used for AMSI bypass;therefore, the process was abnormally terminatedDisable-Windows-Defender••

https://github.com/NYAN-x-CAT/Disable-Windows-Defender
Require administrator privileges before running40

NanoCore Operator Actions – Case 3• 5 DAYS LATER: 10-13-2020 14:52:27 ~ 15:03:54 (UTC+9)• Took control of the screen through screen sharing ; however, did not manipulate the screen• Executed NjRAT, AsyncRAT, Remcos

NjRAT
AsyncRAT

downloaded from hastebin.com

RemcosUnknown (download from 000webhostapp.com failed)41

NanoCore Operator Actions - Discuss• ​What is the purpose of the operator?
• User reconnaissance• 21 operators carefully checked the browser history, bookmarks, and mailboxes in the mailer• 24 operators checked the Desktop, Documents and shared folders• Email account/passwords and the files theft• 37 operators stole email accounts and passwords• 8 operators stole the files. Up to 221 files was stolen• Backdoor installation• 12 operators were infected with malware other than NanoCore• 11 different types of malware were used42

NanoCore Operator Actions - Discuss• What caused the operator to leave?

When they realized it was a fake user:• Did he/she notice that it was an analysis

environment?

• Mailboxes (inbox, sent, draft) were empty• No browsing history• Used systeminfo command to check the environment• VM detection• Malware that only works on Windows10 has been

executed

shutdown

locked the screen• Their target was different• The experiment was conducted between 9 o'clock and18 JST (UTC+9) on weekdays• OS language setting and file contents were Japanese• GeoIP of the IP address is in Japan

talked to us via chatuninstalled NanoCore43

Conclusion• Long-term observations of NanoCore C2 servers• C2 servers primarily located in the USA and Europe• Most of the servers are running between 9:00 and 18:00• Running multiple RATs in combination• NanoCore operator attraction experiment• Many operators stole email account/passwords• Infected RATs other than NanoCore for a secondary infection• Future work• Setting up an environment, in which the operators are less likely to detect us• Scanning for VPNs and proxies commonly used by attackers may help detect RATs otherthan NanoCore
44