nanocore | 91b9e5401ca19ff3f45d8c3acce6a793f7cb713bc6920d9c5371197ad6a3b582

General

Target

App.bin.exe
Size

560KB
MD5

5518020384ceb599dd993c388c21acf3
SHA1

11c3c0a314b76eb980f69c5db4807cc147e3a1d6
SHA256

91b9e5401ca19ff3f45d8c3acce6a793f7cb713bc6920d9c5371197ad6a3b582
SHA512

7767e0edc52c158a1c3aca4c6dfba33bdade555238b238f82c25aa98e21db1cff479aaced3e570419e9767aabdbb10e03eb51debd016b93ba4c681b5432ce001

Score

10^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

App.bin.exe

description pid process

Token: SeDebugPrivilege 3656 App.bin.exe
Token: SeDebugPrivilege 3656 App.bin.exe

description	pid	process
Token: SeDebugPrivilege	3656	App.bin.exe
Token: SeDebugPrivilege	3656	App.bin.exe

Drops file in Program Files directory 2 IoCs

Processes:

App.bin.exe

description	ioc	process
File created	C:\Program Files (x86)\SCSI Manager\scsimgr.exe	App.bin.exe
File opened for modification	C:\Program Files (x86)\SCSI Manager\scsimgr.exe	App.bin.exe

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

App.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Manager = "C:\\Program Files (x86)\\SCSI Manager\\scsimgr.exe"	App.bin.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

512 schtasks.exe
864 schtasks.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

App.bin.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA App.bin.exe

pid	process
512	schtasks.exe
864	schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	App.bin.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

App.bin.exe

description	pid	process	target process
PID 3656 wrote to memory of 512	3656	App.bin.exe	schtasks.exe
PID 3656 wrote to memory of 512	3656	App.bin.exe	schtasks.exe
PID 3656 wrote to memory of 512	3656	App.bin.exe	schtasks.exe
PID 3656 wrote to memory of 864	3656	App.bin.exe	schtasks.exe
PID 3656 wrote to memory of 864	3656	App.bin.exe	schtasks.exe
PID 3656 wrote to memory of 864	3656	App.bin.exe	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

App.bin.exe

pid process

3656 App.bin.exe
3656 App.bin.exe
3656 App.bin.exe
3656 App.bin.exe
3656 App.bin.exe
3656 App.bin.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

App.bin.exe

pid process

3656 App.bin.exe
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

pid	process
3656	App.bin.exe

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SCSI Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB948.tmp"
2⤵
- Creates scheduled task(s)
PID:512

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SCSI Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBAA1.tmp"
2⤵
- Creates scheduled task(s)
PID:864