nanocore | d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf

General

Target
d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe
Size 203KB
Sample200624-ven71qt3nn
SHA256 d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf
MD5 7d2dd2149811382a885829ce77837528
SHA1 5cf0cf077b26c3532a564650a67e84fbaae280d8
SHA512 0f8b4f4789d367f72e0bfcd4b02ab6d5e2453371321e91bdd248a60d83c5f82e12bf24b206682d299c867be52379b234c721117c39e2c29a2252b9029bf5631c
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3180	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe	66
PID 3824 wrote to memory of 3180	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe	66
PID 3824 wrote to memory of 3180	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe	66
PID 3824 wrote to memory of 808	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe	68
PID 3824 wrote to memory of 808	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe	68
PID 3824 wrote to memory of 808	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe	68

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Manager = "C:\\Program Files (x86)\\SCSI Manager\\scsimgr.exe"	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SCSI Manager\scsimgr.exe	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe
File opened for modification	C:\Program Files (x86)\SCSI Manager\scsimgr.exe	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3180	schtasks.exe
808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe
3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe
3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3824	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

C:\Users\Admin\AppData\Local\Temp\d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe
"C:\Users\Admin\AppData\Local\Temp\d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
PID:3824
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "SCSI Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAB1F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3180
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "SCSI Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAC78.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:808