nanocore | 708e8ea4397b44ad8e1ea8ef53b0697dec1e09b6c454c7bf4654120e04a903f8

General

Target
uK4c13RrZFN6qJo.exe
Size 522KB
Sample200827-e3fe9khf42
SHA256 708e8ea4397b44ad8e1ea8ef53b0697dec1e09b6c454c7bf4654120e04a903f8
MD5 d400f891031192908e80635dd6ac9cee
SHA1 65330784185defd5c70579e697565828805332b3
SHA512 3b13b630e2b2cc4095ff1e667ec2ed080882635adbcb29efb33340750e92c4eef21177cc00ba22f628e8bff3cc51bd06161d2b9953b4978de29b4a61e58dc61b
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 3500	2460	uK4c13RrZFN6qJo.exe	70

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3500	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	uK4c13RrZFN6qJo.exe
Token: SeDebugPrivilege	3500	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3844	2460	uK4c13RrZFN6qJo.exe	67
PID 2460 wrote to memory of 3844	2460	uK4c13RrZFN6qJo.exe	67
PID 2460 wrote to memory of 3844	2460	uK4c13RrZFN6qJo.exe	67
PID 2460 wrote to memory of 4008	2460	uK4c13RrZFN6qJo.exe	69
PID 2460 wrote to memory of 4008	2460	uK4c13RrZFN6qJo.exe	69
PID 2460 wrote to memory of 4008	2460	uK4c13RrZFN6qJo.exe	69
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70
PID 2460 wrote to memory of 3500	2460	uK4c13RrZFN6qJo.exe	70

C:\Users\Admin\AppData\Local\Temp\uK4c13RrZFN6qJo.exe
"C:\Users\Admin\AppData\Local\Temp\uK4c13RrZFN6qJo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gBxjwKtdrP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6AEA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3844
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:4008
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3500