nanocore | fcfbd97a36604b87573118a94eb16adfa19d2d13f731565120b6f17a6845dda7

General

Target
NEW ORDER.exe
Size 471KB
Sample200819-c1l3fzv2ba
SHA256 fcfbd97a36604b87573118a94eb16adfa19d2d13f731565120b6f17a6845dda7
MD5 ba68f5428619cf1da97b225983d6930c
SHA1 c6dc3182f9b7000d99c1b1055e32bb9a800887d6
SHA512 beb8565386ea0c2b07f9a6e859e225cf244a2d230f9d17a1c2675a75a1fd6a25cca7f3d34f3cf447035e26410472ef1c815ee3e3300c0cab87d67c540833a103
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 3836	3828	NEW ORDER.exe	69

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3836	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	NEW ORDER.exe
Token: SeDebugPrivilege	3836	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3952	3828	NEW ORDER.exe	67
PID 3828 wrote to memory of 3952	3828	NEW ORDER.exe	67
PID 3828 wrote to memory of 3952	3828	NEW ORDER.exe	67
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69
PID 3828 wrote to memory of 3836	3828	NEW ORDER.exe	69

C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imSHfVbPQN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBEC7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3952
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3836