nanocore | 708e8ea4397b44ad8e1ea8ef53b0697dec1e09b6c454c7bf4654120e04a903f8

General

Target
uK4c13RrZFN6qJo.exe
Size 522KB
Sample200827-e3fe9khf42
SHA256 708e8ea4397b44ad8e1ea8ef53b0697dec1e09b6c454c7bf4654120e04a903f8
MD5 d400f891031192908e80635dd6ac9cee
SHA1 65330784185defd5c70579e697565828805332b3
SHA512 3b13b630e2b2cc4095ff1e667ec2ed080882635adbcb29efb33340750e92c4eef21177cc00ba22f628e8bff3cc51bd06161d2b9953b4978de29b4a61e58dc61b
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 1104	1420	uK4c13RrZFN6qJo.exe	26

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1104	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	uK4c13RrZFN6qJo.exe
Token: SeDebugPrivilege	1104	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1600	1420	uK4c13RrZFN6qJo.exe	24
PID 1420 wrote to memory of 1600	1420	uK4c13RrZFN6qJo.exe	24
PID 1420 wrote to memory of 1600	1420	uK4c13RrZFN6qJo.exe	24
PID 1420 wrote to memory of 1600	1420	uK4c13RrZFN6qJo.exe	24
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26
PID 1420 wrote to memory of 1104	1420	uK4c13RrZFN6qJo.exe	26

C:\Users\Admin\AppData\Local\Temp\uK4c13RrZFN6qJo.exe
"C:\Users\Admin\AppData\Local\Temp\uK4c13RrZFN6qJo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gBxjwKtdrP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF39.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1600
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1104